Cloud / Container / Kubernetes Security

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-pentest.md — Cloud/K8s testing requires written authorization

2. NOW: case-init + scope；明确accountBoundary、禁止破坏性operation

3. NOW: Confirm it's cloud metadata/container/K8s/IAM, not ordinary web scanning (latter → pentest-tools/)

4. NEXT: tool-index；kubectl/aws/gcloud etc.multi-isManualInstall

5. ACT: from「IdentityandExposure surface」开始，禁止defaultall网Scan

Scope

• cloud metadata SSRF（ / IMDS）

• IAM excessivePermission、公开存储桶、ErrorSecurityGroup

• Docker/containerd EscapePathAssessment

• Kubernetes RBAC、Secrets、Admission、供应 chainImage

• Container imagevulnerability（canintegration supply-chain-security/）

Workflow

Phase 1 — IdentityandBoundary

□ whenbeforeIdentity：cloud AK/SK、K8s SA、Node SSH？

□ Scope：singleaccount / single cluster / single namespace

□ Network档：authorized_target_only

Phase 2 — cloudControl surface

# Example (replace by vendor; MUST be within authorized account)

aws sts get-caller-identity

aws s3 ls

# Azure / GCP corresponding identity commands

□ 公开桶 / Error ACL

□ Metadata: IMDSv1 vs v2; SSRF chain

□ Rolecan扮演（PassRole）andLateral

Phase 3 — Container

□ Is it privileged / hostPath / hostNetwork

□ capabilities（SYS_ADMIN  etc.)

□ canwrite宿主机Path → Escape候选

□ Imagehistoricalandalreadyknow CVE → Trivy

Phase 4 — Kubernetes

kubectl auth can-i --list

kubectl get pods,secrets,svc -A

kubectl get clusterrolebindings

□ SA token MountandPermission

□ dangerous admission webhook missing

□ etcd / dashboard Exposure

□ NetworkPolicywhetherdefault放行

Toolchain

| Tool | purpose | bootstrap |

|------|------|------|

| kubectl | Cluster交互 | Manual |

| trivy | Image/IaC | bootstrap trivy ifcanuse |

| kube-bench / kubeaudit | CIS/Configuration | Manual |

| pacu / scoutsuite | Cloud audit（Authorization） | Manual |

| nuclei | Known cloud vulnerability templates | bootstrap nmap/nuclei 生态 |

References

• references/k8s-cloud-checklist.md

• CTF to照：../../CTF-Sandbox-Orchestrator/competition-agent-cloud/

• ../supply-chain-security/ ../pentest-tools/

Routing context

Upstream: MASTER R23

Downstream: 拿toNode shell → attack-chain / windows-ad；Imagevulnerability → supply-chain

MUST NOT: Scan other tenants in public cloud without authorization

Task completion checklist

• Limited to authorized account/cluster？

• Discoverywhether含复现andImpact？

• Did you avoid destructive operations？

• Report / journal？