Offensive security assessments

Core Concepts

Why it matters

Container and Kubernetes assessment evaluates how images, containers, and the orchestrator are built and configured. Containers share the host kernel rather than fully virtualizing it, so the central question is whether an attacker can break out of a container or move laterally across the cluster. Methodology / Phases: - Scan images: check base images and layers for vulnerabilities, embedded secrets, and excessive contents. - Review runtime config: privileged containers, mounted host paths, capabilities, and exposed sockets (e.g. the Docker socket). - Test container escape: kernel exploits, misconfigurations, and dangerous mounts that reach the host. - Assess the cluster: Kubernetes RBAC, service accounts, network policies, secrets handling, and the API server exposure. - Map lateral movement: from a pod to other pods, nodes, the control plane, and cloud metadata/credentials. Key Concepts / What to look for: - Privileged and over-capable containers: --privileged, added capabilities, and host namespace sharing. - Dangerous mounts: the Docker socket, host filesystem, or /proc exposed inside a container. - Image hygiene: vulnerable packages, hardcoded secrets, and outdated or unpinned base images. - Kubernetes RBAC and secrets: overly broad roles, default tokens, and plaintext or readable secrets. - Weak isolation: missing network policies, exposed dashboards/kubelet, and reachable cloud metadata.

How we test it

Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.

Testing approach

Structured validation of Core Concepts during scoped assessment.
Evidence captured with reproducible steps for your engineering team.

What we look for

Misconfigurations and control gaps related to Core Concepts.
Exploitable paths that could affect confidentiality, integrity, or availability.

Related topics

Topic	Summary
1. Container Security Assessment:	We validate this area during scoped assessments, documenting impact and remediation guidance.
10. Orchestration Platform Security:	We validate this area during scoped assessments, documenting impact and remediation guidance.
11. Auditing and Logging:	We validate this area during scoped assessments, documenting impact and remediation guidance.
12. Security Monitoring:	We validate this area during scoped assessments, documenting impact and remediation guidance.
13. Container Signing and Verification:	We validate this area during scoped assessments, documenting impact and remediation guidance.
14. Container Runtime Policies:	We validate this area during scoped assessments, documenting impact and remediation guidance.