kubenumerate 2.1.5

A comprehensive Kubernetes security auditing tool

Kubenumerate

Enumerate your target Kubernetes cluster with just 1 command! :eyes:

Motivation

• Concerned about your Kubernetes cluster's security?
• Are you going to use tools like kubeaudit, kube-bench, and trivy anyway?
• Do you want all done for you with one lazy command and exported to excel?

Enter kubenumerate!

With just 1 command it will locate or install (with permission) all the necessary tools, enumerate the whole current context, spit out a spreadsheet containing any juicy info and raise some found issues to the CLI. A handy containerised version is released in case you don't want to pollute the system with access to the target cluster's Kubernetes API with these tools, more info below in the containerised version section.

Currently included tools:

• Kubeaudit (installing latest from brew cask)
• Kube-bench (installing latest release from GitHub: aquasecurity/kube-bench - releases)
• Kubectl (installing latest from brew cask)
• Trivy (installing latest from brew cask)
• KubiScan (installing latest release from GitHub: cyberark/KubiScan - releases)
• ExtensiveRoleCheck.py (custom version included in the repo, thanks to PalindromeLabs' fork from the original CyberArk's file)

Usage

┌──(subtle㉿SubtleLabs)-[~]
└─# kubenumerate -h

             +-----+  1. -----
            /     /|  2. -----
           +-----+ |  3. -----
           |     | +  4. -----
           |     |/  5. -----
           +-----+  6. -----
             Kubenumerate
          By 0x5ubt13 v2.0.3

usage: kubenumerate.py [-h] [--cheatsheet] [--dry-run] [--excel-out EXCEL_OUT] [--files FILES] [--kubeconfig KUBECONFIG]
                   [--namespace NAMESPACE] [--output OUTPUT] [--trivy-file TRIVY_FILE] [--verbosity VERBOSITY]
                   [--skip-summary] [--summary-output SUMMARY_OUTPUT]

Uses local kubeconfig file to launch kubectl, trivy and KubiScan and parses all useful output to excel.

options:
-h, --help              show this help message and exit
--cheatsheet, -c        Print commands to extract info from the cluster and work offline
--dry-run, -d           Don't contact the Kubernetes API - do all work locally
--excel-out EXCEL_OUT, -e EXCEL_OUT
                        Select a different name for your excel file. Default: kubenumerate_results_v1_0.xlsx
--files FILES, -f FILES
                        Instruct Kubenumerate to use an already generated kubectl_output directory with all the necessary files to work
                        offline (pods.json, deployments.json, etc). Forces --dry-run mode.
--kubeconfig KUBECONFIG, -k KUBECONFIG
                        Select a specific Kubeconfig file you want to use
--namespace NAMESPACE, -n NAMESPACE
                        Select a specific namespace to test, if your scope is restricted. Default: -A
--output OUTPUT, -o OUTPUT
                        Select a different directory for all the output. Default: '/tmp/kubenumerate_out/'
--trivy-file TRIVY_FILE, -t TRIVY_FILE
                        Run trivy from a pods dump in json instead of running kubectl using your kubeconfig file
--verbosity VERBOSITY, -v VERBOSITY
                        Select a verbosity level. (0 = quiet | 1 = default | 2 = verbose/debug)
--skip-summary, -s      Skip generating the summary table in Microsoft Word format (generated by default)
--summary-output SUMMARY_OUTPUT
                        Specify the path for the summary Word document. Default: {output_dir}/kubenumerate_summary.docx

Installation (pipx ✨)

pipx install kubenumerate

Installation (from source)

git clone https://github.com/0x5ubt13/kubenumerate.git && \ 
cd kubenumerate && \ 
python3 -m venv venv && \ 
source venv/bin/activate && \ 
python -m pip install . && \ 
kubenumerate -h

Note: kubenumerate orchestrates external tools such as kubectl, kubeaudit, kube-bench, trivy, kubiscan, jq, and wget. When you run it, it can prompt to install missing tools, but you can also install them manually beforehand.

Examples

Run using your kubeconfig file (simply call the script!)

kubenumerate

Run locally using extracted pods.json (no kubeconfig file needed)

kubenumerate -o ./kubenumerate_out/dev_cluster -t pods-dev.json --dry-run

Skip the summary table generation (only generate Excel)

kubenumerate --skip-summary

Specify custom path for summary document

kubenumerate --summary-output /path/to/my_report.docx

Output

Kubenumerate generates two types of output:

1. Detailed Excel Workbook (Default: kubenumerate_results_v1_0.xlsx)

Contains detailed findings across multiple sheets:

• AppArmor - AppArmor profile issues
• Automount SA - Service account token automounting issues
• Capabilities - Linux capabilities configurations
• Deprecated API - Deprecated Kubernetes API usage
• Host Namespace - Host PID/Network namespace usage
• Limits - Resource limits configuration
• Mounts - Sensitive path mounts
• Network Policies - Network policy configurations
• Non Root - RunAsNonRoot configurations
• Privilege Escalation - allowPrivilegeEscalation settings
• Privileged - Privileged containers
• Root Filesystem - Read-only root filesystem settings
• Seccomp - Seccomp profile configurations
• Vulnerable Images - Container images with CVEs (from Trivy)

2. Word Summary Table (Default: kubenumerate_summary.docx) - Generated Automatically

A concise, executive-friendly summary showing:

• Namespace - Where the workload is deployed
• Workload - Name of the resource
• Type - Resource kind (Deployment, DaemonSet, StatefulSet, Job, CronJob)
• Issues - List of security/config issues affecting the workload

Features:

• Excludes ephemeral Pods (shows parent controllers only)
• Intelligent ReplicaSet deduplication (avoids showing Deployment-managed ReplicaSets)
• Professional formatting with colored headers and alternating row colors
• Summary statistics at the bottom

To skip summary generation: Use --skip-summary or -s flag

Containerised version

If you don't want to install everything in your system, a containerised version is available at Docker Hub: gagarter/kubenumerate.

You will need to mount your kubeconfig file inside the container, along with any cloud file or env variable needed for the container to authenticate to a CSP, then mount the desired output directory inside the container, and after running, it will dump all the output in the mounted directory.

A basic example of how can this be done:

# Create directory and prepare kubeconfig file and out directory
mkdir /tmp/kubenumerate_out
cp ~/.kube/config /tmp/config
chmod a+r /tmp/config
chmod a+w /tmp/kubenumerate_out

# Run the program
docker run \
    --network host \
    --name kubenumerate \
    -v /tmp/config:/home/subtle/.kube/config \
    --mount type=bind,source=/tmp/kubenumerate_out,target=/tmp/kubenumerate_out \
    gagarter/kubenumerate

# Clean up
printf "Removing container -> "; docker rm kubenumerate
rm /tmp/config

or, if you're using PowerShell on Windows:

# Create directory and prepare kubeconfig file and out directory
New-Item -Path "C:\tmp\kubenumerate_out" -ItemType Directory
Copy-Item -Path "$env:USERPROFILE\.kube\config" -Destination "C:\tmp\config"
icacls "C:\tmp\config" /grant Everyone:R
icacls "C:\tmp\kubenumerate_out" /grant Everyone:W

# Run the program
docker run `
    --network host `
    --name kubenumerate `
    -v C:\tmp\config:/home/subtle/.kube/config `
    --mount type=bind,source=C:\tmp\kubenumerate_out,target=/tmp/kubenumerate_out `
    gagarter/kubenumerate

# Clean up
Write-Output "Removing container -> "; docker rm kubenumerate
Remove-Item -Path "C:\tmp\config"

If you want to build the image yourself, simply clone the repo, cd into it, make any changes you want to the source code and use docker build:

git clone https://github.com/0x5ubt13/kubenumerate.git
cd kubenumerate
# Edit the repo as you like, then:
docker build -t gagarter/kubenumerate:your_custom_tag .

Other enumeration tools you might be interested in

I developed a fully automated enumeration tool that performs infrastructure scans, which gained some traction but needs feedback, so feel free to try GitHub - 0x5ubt13/Enumeraga if you're going to play a CTF (single target scan) or do an infra job (subnet range scan).

To Do

• Add verbose flag
• Containerise
• Offer the user to install all reqs for them
• Clear all TODOs