kubenum

kubenum is a command-line tool designed to perform enumeration on a Kubernetes cluster from within a Pod. kubenum do not need any permission on the cluster, indeed, it is built for penetration testers to help them enumerate Pods and Services without using the kube-api and the Pod's ServiceAccount (which is not granted any permission 99% of the time). It primarily focuses on making DNS requests to retrieve information about Pods and Services.

TL;DR;

./kubenum auto

Installation

From the release page

https://github.com/Orange-Cyberdefense/kubenum/releases

Manual

If you have go installed

To directly run using go

go run main.go

You can also build the executable

go build -o kubenum main.go

If you don't have go installed

docker run --rm -v $PWD:/app -w /app golang:1.23-alpine go build main.go -o kubenum

Usage

Auto

With auto mode, kubenum will retrieve cluster version, the local IP address as well as environment variables to determine used CIDRs. It then use internal DNS to retrieve Pods and Services.

./kubenum auto

You can use -o to write found IPs to a file.

./kubenum auto -o ips.txt

Enumerate from CIDR

kubenum can enumerate Pods and Services matching a given CIDR.

./kubenum cidr --cidr 10.42.0.0/16 --cidr 10.42.0.0/16

If you know you are running in a particular cloud environnement (EKS, AKS, K8S on-premise...), you can use --eks, --aks, --k8s or --k3s to add default ranges for pods and services used by the provider.

./kubenum cidr --eks

Output

By default, kubenum displays the found Pods, Services and ports to stdout. Use --output and --output-format to save it to a file (json, grep and ip-only format are accepted). When saving to a file, only stats are printed to stdout. Use --print to force printing output to stdout as well.

Custom DNS

For testing purpose, if the program is not run from a Pod, you can specify a DNS configuration using

How does it work?

CoreDNS, the internal DNS service of a Kubernetes cluster, has several records based on pods and services running. For each Pod and Service (with an IP address), there is a PTR record of that IP address pointing to a record containing the namespace name and the Service name. If the PTR record exists, the Pod/Service exists and we can extract information:

• A-B-C-D.<service-name>.<namespace>.svc.cluster.local.: this is a pod with ip address A.B.C.D, attached to a Service named <service-name> in the namespace <namespace> (Pods not attached to a service have no PTR record).
• <name>-0.<namespace>.svc.cluster.local.: This is a pod linked to a StatefulSet of name <name> in the namespace <namespace>. 0 indicate this is the first.
• <service-name>.<namespace>.svc.cluster.local: this is a Service with the name <service-name> in the namespace <namespace>.

By requesting only the DNS service, it is possible to enumerate all the Pods and Services, even the ones protected by NetworkPolicies.

The RFC1928 (the list of all private IP addresses) contains more than 17 milion IP address. Doing 17M PTR query would be inefficient. With auto mode, kubenum scans for hints in the Pod that would give information of ranges used by the cluster (env vars, local IP address, cluster version...). It can then query a more limited and accurate list of IP addresses.

Furthermore, there are SRV records that give information about the opened port of a Service. Requesting SRV records for <my-svc>.<my-namespace>.svc.cluster.local will give the port the Service is listening on. Once the services have been listed, kubenum will determines the ports the services are listening.