Advanced Offensive Security
Container & Kubernetes Security
Container escapes, exposed APIs, and lateral movement in orchestration.
Containers and Kubernetes (K8s) run most modern workloads. Attackers target misconfigurations that let them break out of a container or abuse the orchestration layer to take over the whole cluster.
- Privileged / overly-capable containers — --privileged, hostPath mounts, or dangerous capabilities enable host breakout.
- Exposed Docker socket (/var/run/docker.sock) mounted into a container = instant host root.
- Unauthenticated Kubernetes API / kubelet — deploy pods, read secrets.
- Overly permissive RBAC and service-account tokens mounted in pods.
- Reachable etcd — the cluster's secret store.
# Inside a pod: check the mounted service-account token
cat /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl auth can-i --list # what can this token do?
# Enumerate/attack from inside
kubectl get secrets -A