KubeXHunt is an automated Kubernetes post-compromise assessment framework. Drop it onto a compromised pod and get:

• 27 continuous enumeration phases — from pod basics to cluster compromise, node escape, cloud pivoting, and supply chain attacks
• Automated attack chain generation — finds paths from your current pod to cluster-admin, complete with exploitation steps
• Zero external dependencies — runs on Python 3.9+ stdlib only; works on any Kubernetes cluster
• Multi-cloud support — detects and pivots through EKS IRSA, GKE Workload Identity, Azure Pod Identity
• Structured findings — MITRE ATT&CK for Containers, CWE, CIS Benchmark, and CVSS 3.1 severity mapping
• Multiple output formats — JSON, HTML, SARIF (for CI/CD), Markdown, and GraphViz attack graphs

Credits to Chandrapal Badshah for providing exceptional training on Kubernetes Security, which significantly contributed to the development of this tool and deepened my understanding of Kubernetes security practices.

Special thanks to Payatu for sponsoring and providing access to this training, enabling the research and development behind KubeXHunt.

Kubernetes security tools fall into two camps:

1. Posture scanners (kube-bench, kubescape, Trivy) — find misconfiguration before deployment
2. Network/RBAC analyzers (KubeHound) — map the entire cluster's attack surface from the API

But there's a gap: What happens when you already have code execution inside a pod?

Existing post-compromise frameworks (Peirates, kube-hunter, BOtB) are 3–5 years old and archived. KubeXHunt fills that void by:

• Automating real-world attack chains — not just finding individual vulnerabilities, but chaining them into exploitable path
• Providing in-cluster execution — no kubectl, no API access required; works from a compromised pod
• Generating actionable exploitation code — see the exact shell commands/YAML to move laterally and escalate
• Integrating cloud pivoting — because Kubernetes on EKS/GKE/AKS means compromising the cloud account is the endgame

# Install via pip (Python 3.9+)
pip install kubexhunt

# Verify installation
kubexhunt --help

# Retrieve the report
kubectl logs kubexhunt-scan > report.json

# Clone and install
git clone https://github.com/mr-xhunt/kubeX.git
cd kubexhunt
pip install -e ".[dev]"

# Run a full assessment
python3 -m kubexhunt --output report.html

# Run specific phases (read-only)
python3 -m kubexhunt --phase 1 2 3 --no-mutate

# Run in stealth mode
python3 -m kubexhunt --stealth 2 --fast --no-mutate

python3 kubexhunt.py --output report.json --diff previous.json

# 1. Run KubeXHunt
kubexhunt --output report.json

# 2. Review findings
# - Finding: ServiceAccount has get/create pod permissions
# - Finding: IMDS endpoint reachable (EC2 metadata)
# - Finding: Workload Identity binding detected (IRSA)

# 3. See the attack chain
# Pod (default/app) 
#   → Can create pods (RBAC)
#   → Create privileged pod with hostPath:/ (node escape)
#   → Access /var/lib/kubelet/kubeconfig (steal higher-priv token)
#   → Use stolen token to query all secrets (including IRSA token)
#   → IRSA token → AWS STS credentials
#   → AWS CLI: aws s3 ls → s3://prod-database-backups/
#   → Exfil production database

# 4. Generated PoC (from KubeXHunt output):
# kubectl create pod privileged-escape --image=alpine ... hostPath:/ ...
# export TOKEN=$(curl http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
# curl http://169.254.169.254/latest/meta-data/iam/security-credentials -H "X-aws-ec2-metadata-token: $TOKEN"

Use --stealth to skip LOUD phases in production:

python3 kubexhunt.py --stealth 2 --no-mutate  # Skip LOUD & MEDIUM, read-only

Every finding includes:

• MITRE ATT&CK for Containers technique IDs (e.g., T1078.001 Valid Accounts)
• CWE and CVSS 3.1 scores
• CIS Kubernetes Benchmark control mappings
• Remediation steps with effort estimates
• Attack paths showing how this finding chains to compromise

Example finding (JSON):

{
  "id": "RBAC-WILDCARD-001",
  "title": "ClusterRole with overly permissive wildcard verbs",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "mitre": ["T1078.001", "T1087.002"],
  "cwe": ["CWE-276"],
  "attack_paths": [
    {
      "path_id": "PATH-001",
      "nodes": ["sa:default:app", "clusterrole:viewer", "secret:kube-system:admin-token", "CLUSTER_ADMIN"],
      "steps": ["Use SA to list ClusterRoles", "Find wildcard verbs", "Read all secrets", "Extract admin token"]
    }
  ],
  "remediation": {
    "summary": "Restrict ClusterRole permissions to only required verbs",
    "steps": [
      {"step": "kubectl patch clusterrole viewer ...", "effort": "LOW"}
    ]
  }
}

Visualize your route to cluster compromise:

[Compromised Pod]
  ↓ CAN_CREATE_POD (RBAC)
[Malicious Pod with hostPath:/]
  ↓ CAN_ESCAPE_TO_NODE
[Node Root Shell]
  ↓ MOUNTS_ALL_SA_TOKENS
[Stolen Cluster-Admin Token]
  ↓ CAN_IMPERSONATE
[Cluster Admin]

Export as:

• D3.js interactive HTML (click to zoom/filter)
• Graphviz DOT (render with dot -Tpng)
• Neo4j Cypher queries (for further analysis)

Each check is rated for detectability:

• ⚪ SILENT — Indistinguishable from normal behavior
• 🟢 QUIET — Hard to detect without dedicated monitoring
• 🟡 MEDIUM — Visible in standard audit logs
• 🔴 LOUD — Obvious anomalies, immediate detection

Use stealth levels to balance coverage vs. noise:

--stealth 0   # Run all phases (maximum noise)
--stealth 1   # Skip LOUD phases (good balance)
--stealth 2   # Skip LOUD + MEDIUM (minimal noise, limited coverage)

python3 kubexhunt.py --output report.json      # Machine-readable
python3 kubexhunt.py --output report.html      # Interactive UI
python3 kubexhunt.py --output report.sarif     # CI/CD integration
python3 kubexhunt.py --output report.txt       # Console-friendly
python3 kubexhunt.py --output report.graphviz  # Attack graphs

# Compare against a previous scan
python3 kubexhunt.py --diff previous.json

# Shows: new findings, resolved findings, regressions

pip install kubexhunt

git clone https://github.com/mr-xhunt/kubeX.git
cd kubexhunt
pip install -e .
python3 -m kubexhunt --help

• Simulate post-breach K8s cluster compromise
• Generate realistic attack scenarios
• Test incident response workflows

• Continuous cluster monitoring (run nightly)
• Regression detection (compare scans over time)
• CISO reporting (HTML/SARIF for dashboards)

• Pre-prod cluster hardening validation
• Compliance audits (CIS Benchmark mapping)
• Incident investigation ("was this cluster already compromised?")

• Graph-based cluster analysis
• Novel privilege escalation paths
• CVE-to-K8s-exploitation chains

• Getting Started Guide — Installation and first scan
• Phase Reference — Detailed description of each phase
• Architecture — System design and module overview
• Contributing — How to add new features and fixes
• Security Policy — Responsible vulnerability disclosure
• Roadmap — Future directions and priorities

export KUBECONFIG=/path/to/kubeconfig
python3 kubexhunt.py --no-mutate --output test-cluster-report.json

python3 kubexhunt.py --mutate --exploit daemonset-root --output attacker-poc.json

python3 kubexhunt.py --output sarif-report.sarif --phase 1 2 3
# Upload to GitHub via:
# gh api repos/OWNER/REPO/code-scanning/sarifs --input sarif-report.sarif

python3 kubexhunt.py --output today.json --diff yesterday.json
# Shows: NEW findings, FIXED findings, REGRESSIONS

• GitHub Issues — Report bugs
• Discussions — Ask questions
• Contributing — Add features
• Security — Report vulnerabilities

MIT License. See LICENSE for details.

KubeXHunt was inspired by:

• Peirates (InGuardians) — post-compromise K8s exploitation
• kube-hunter (Aqua) — K8s vulnerability discovery
• BloodHound (SpecterOps) — AD attack graph model
• KubeHound (Datadog) — Kubernetes attack graph

Special thanks to the Kubernetes security community for research and feedback.

KubeXHunt is a security assessment tool designed for authorized testing only.

• Only run against clusters you own or have explicit written authorization to test
• Unauthorized access to computer systems is illegal
• Authors assume no liability for misuse

See SECURITY.md for responsible disclosure guidelines.

Ready to assess your cluster?

python3 kubexhunt.py --output report.html
open report.html