CyberArk recently announced a new open-source project, Kubesploit, for testing Kubernetes environments.
The goal of the project is to assist pen testers with performing comprehensive security assessments that mimic real-world attack scenarios, CyberArk explained.
“To help protect Kubernetes clusters from attacks, we need to face the technology and the organizations being targeted. Yet, most of the tools available today are aimed at passive scanning for vulnerabilities in the cluster, and there is a lack of more complex attack vector coverage. These tools might allow you to see the problem but not exploit it. It is important to run the exploit to simulate a real-world attack in order to determine corporate resilience across the network,” Eviatar Gerzi, cybersecurity researcher at CyberArk, wrote in a post.
Kubesploit is written in Golang and builds on the Merlin HTTP/2 Command & Control server and agent.
CyberArk already had two open-source projects for Kubernetes, KubiScan and kubelectl. With Kubesploit, the company can offer a single, centralized tool for testing these environments.
In addition, CyberArk has set up a Kubernetes environment in Katacoda that can be used to experiment with the tool. It includes a set of automated instructions on how to use Kubesploit.
