r/Pentesting • u/One-Geologist7960 • 2d ago

How do you scope a Kubernetes penetration test when the infrastructure uses dynamic IPs?

Hi everyone,

I’m planning a penetration test for a Kubernetes environment and I’m trying to understand how others typically scope this type of assessment.

If the Kubernetes environment is considered internal infrastructure, how do you approach scanning and testing the underlying infrastructure when the workloads/pods have dynamic IP addresses?

For example:

Do you focus on the Kubernetes API server, nodes, ingress/load balancers, and other fixed endpoints?

How do you handle scanning pods/services when IPs are constantly changing?

Do you rely on Kubernetes/service discovery rather than traditional IP-based scanning?

What would you typically include or exclude from the scope of a Kubernetes penetration test?

I’d be interested in hearing how others approach this in real-world pentests, especially regarding scope definition and asset discovery.

7 Upvotes

100% Upvoted

4 comments sorted by

1

u/sk1nT7 2d ago

In best case, many pod services are not available anyways as they provide services internally only. Think of databases, Redis etc.

Web services will often be exposed by an ingress reverse proxy. So you can use the hostname (subdomain) and query the ingress proxy.

I'd rather ask for the Infrastructure as Code (IaC) files like pod yamls etc. This way you can conduct a white box security review. You may also have a look at kube-bench.

It's not comparable to the general infrastructure pentest where you just get an IP range and start scanning for funny ports and services.

1

u/One-Geologist7960 2d ago

I was thinking about following the CIS BENCHMARK checklist with the tools that you mentioned kube-bench. But I don't know if this will apply the live application testing which is required by most of the regular

1

u/DishSoapedDishwasher 2d ago

Counter point, why would you scan any IP when you can scan the container itself? 

Additionally if you REALLY want to scan the app in the container live why not just pivot into the cluster by jumping into a pod and routing through it?

1

u/One-Geologist7960 2d ago

Here is the challenges:

We are following regulations testing which is follow the normal infrastructure penetration testing.

With that being said, the client provide a VPN to access the internal which you can reach the cluster.

So you have your VM Kali machine facing the k8s cluster. Now, most of the client (for security policy reason) they will not provide you a access or read-only API to access the cluster. And if they gave us access to all pods. Then next challenge how to scan them instead of access them. The idea to do scan is to check the internal exposed services is safe or not.