KubePwn (ebook) Rydułtowy

DescriptionKubernetes has become the backbone of modern cloud-native applications, but it is also a high-value target for attackers. As organizations rapidly adopt containers, service meshes, and automation, securing Kubernetes clusters has become an active security battle.This book takes a hands-on, end-to-end approach to Kubernetes security. It begins by exploring real-world attack surfaces, guiding readers through container enumeration, RBAC abuse, and cluster takeover techniques. The focus then shifts to defense, covering Kubernetes audit log analysis, runtime detection, monitoring with Prometheus, and incident response. From an offensive perspective, you will learn to scan exposed services, deliver reverse shell payloads, and enumerate internal cluster metadata. Switching to defensive operations, you will conduct threat hunting using API audit logs, correlate runtime telemetry to reconstruct incident kill chains, and run automated tools. Each chapter is built around practical demonstrations that mirror how attacks and detections occur in real environments.By the end of this book, readers will gain real-world proficiency in both offensive cluster exploitation and defensive forensic analysis in Kubernetes environments. They will be able to identify and exploit common weaknesses, detect malicious behavior, and design Kubernetes clusters.What you will learn Exploit real Kubernetes misconfigurations used in production attacks. Perform container enumeration, breakout, and cluster escalation techniques. Detect attacks using audit logs and runtime security tools. Hunt threats with Falco, Sysdig, Prometheus, and SIEM. Analyze network traffic for lateral movement and data exfiltration. Reconstruct Kubernetes attack kill chains and respond effectively.Who this book is forThis book is for security engineers, DevSecOps practitioners, Kubernetes administrators, red teamers, and SOC analysts securing cloud-native environments. Readers should possess basic Linux administration skills, familiarity with Docker container fundamentals, and a foundational understanding of networking concepts and kubectl command-line usage.Table of Contents1. Introduction to KubePwn Labs2. Learning Kubernetes Architecture3. KubePwn Lab Setup4. Infiltrating Kubernetes Cluster5. Enumerating Kubernetes like a Pro6. Privilege Escalation to Cluster Takeover7. Threat Hunting and Forensics8. Identifying Misconfigurations in K8s Cluster O autorze: Deepanshu Khanna is a 29-year-old information security and cybercrime consultant and a pioneer in his country. The young and dynamic personality of Deepanshu has not only assisted him in handling information security and cybercrimes but also in creating awareness about these things. He’s a hacker appreciated by the Indian government, including the Ministry of Home Affairs and Defence, police departments, and many other institutes, universities, globally renowned IT firms, magazines, and newspapers. He started his career by presenting a popular hack of GRUB at HATCon. He also conducted popular research in the fields of IDS and AIDE and demonstrated MD5 collisions and Buffer overflows, among other things. His work has been published in various magazines such as pentestmag, Hakin9, e-forensics, SD Journal, and hacker5. He has been invited as a guest speaker to public conferences such as DEF CON, ToorCon, OWASP, HATCon, H1hackz, and many other universities and institutes.