Kubernetes Hacking: From Weak Applications to Cluster Control

แชร์
ฝัง
  • เผยแพร่เมื่อ 4 ก.พ. 2025

ความคิดเห็น •

  • @einpseudonym7604
    @einpseudonym7604 ปีที่แล้ว +28

    Great topic, especially in this time and age very cool to see container vulnerabilities in action

  • @Quephara
    @Quephara ปีที่แล้ว +53

    I need to buy glasses, that's probably this guy's superpower

    • @reinmarvonzweter666
      @reinmarvonzweter666 ปีที่แล้ว +2

      Maybe try growing a beard?

    • @the_sandman00
      @the_sandman00 ปีที่แล้ว +2

      Tried it. It’s not

    • @vq8gef32
      @vq8gef32 ปีที่แล้ว

      LooL

    • @petevenuti7355
      @petevenuti7355 ปีที่แล้ว

      ​@@the_sandman00 it was for me, back when I was 14..

    • @Damian04233
      @Damian04233 ปีที่แล้ว +1

      Dude.. I promise you that though they are not the source of his superpower -😐 they are without a doubt, im telling you beyond likely, we're talking menswearhouse, multiplying his powers anywhere between a standard 50%, like you get from sunglasses to upwards of 2500% depending on who made the frames, if they're Luxottica, pssh¡, fuhgett abod it. I used to be an Optician, I know.

  • @janwrona9539
    @janwrona9539 ปีที่แล้ว +6

    Trick with --path-as-is is super cool ! Currently working with containers and kubernates from a dev perspective but this video brings new point of view for me ! Thanks :)

    • @ttrss
      @ttrss ปีที่แล้ว +2

      that would have got me stuck for so longg

  • @kebien6020
    @kebien6020 ปีที่แล้ว +3

    Some pro-tips for the messed up terminal.
    Try the command stty sane to see if that fixes your shell.
    At the very least you can override your PS1 with something very short to avoid being so close to the end of the screen. Something like:
    export PS1='\w\$ '
    This might even fix the text wrapping in the wrong place, which is caused by bash not knowing accurately how long the prompt text is, because of the control characters that make the prompt have colors.

  • @B44-y5i
    @B44-y5i ปีที่แล้ว +12

    thanks buddy this was basically a step by step guide for discovering major vulnerability in a popular service by pure accident. got me bug bounty money :D

  • @justchecking12
    @justchecking12 ปีที่แล้ว +1

    I like his style when he starts intro speaking it’s like a documentary 😂

  • @1_nS1d3
    @1_nS1d3 ปีที่แล้ว

    Especially for ones interested in technologies like k8s in the security context, I can recommend the book from sparc flow "How to hack like a ghost"

  • @uayew892
    @uayew892 ปีที่แล้ว +10

    Kubernetes will ignore the imagePullPolicy and will always try to pull the image if the image tag is :latest (or none, defaulting to :latest)

  • @exoric7408
    @exoric7408 ปีที่แล้ว

    Great video John ! As always !

  • @vivekmishra69
    @vivekmishra69 ปีที่แล้ว

    Very nice tutorial thanks for sharing. You could have also edited the grafana pod using "kubectl edit grafana pod" and make it previleged pod and mount host directory instead of creating new pod..

  • @wolfrevokcats7890
    @wolfrevokcats7890 ปีที่แล้ว

    3:12 pwncat-cs is superb replacement for netcat

  • @Jim-z9j
    @Jim-z9j 3 หลายเดือนก่อน

    Is it normal for a kube container to have access level to create new containers?

  • @marco201ful
    @marco201ful ปีที่แล้ว

    You should talk about Security Blue Team, I know you helped them build their videos.

  • @klanker
    @klanker ปีที่แล้ว +2

    more kubernetes pls

  • @DEV8795
    @DEV8795 ปีที่แล้ว

    bruh, love it. makes me wanna learn these stuff

  • @raav33n
    @raav33n ปีที่แล้ว +1

    This was super cool. What CTF is this from?

  • @ciaobello1261
    @ciaobello1261 ปีที่แล้ว

    wild video😂 nice, thanks john for it

  • @scorpion_lux
    @scorpion_lux ปีที่แล้ว

    What a fantastic video congratulations as always

  • @pranavpatil7748
    @pranavpatil7748 ปีที่แล้ว +2

    Great video John?
    Can you let us know which machine/image/box you are using

    • @grover-
      @grover- ปีที่แล้ว

      Did anyone get the link to this if it's in hack the box?

  • @iCortex1
    @iCortex1 ปีที่แล้ว +1

    Any plans to cover the google chrome 0 day that happened a few days ago ?

  • @silentkille4
    @silentkille4 ปีที่แล้ว

    this guy deserves a million subs + more

  • @GroupFacade9264
    @GroupFacade9264 ปีที่แล้ว

    I was just thinking gabout this, reading my mind.

  • @manonmission2010
    @manonmission2010 9 หลายเดือนก่อน

    love your high quality videos

  • @gronono
    @gronono ปีที่แล้ว

    Very nice video. Thanks a lot

  • @felipeozoski
    @felipeozoski ปีที่แล้ว

    Another awesome video thank you very much

  • @medamineoueslati9719
    @medamineoueslati9719 8 หลายเดือนก่อน

    When can i find the application i want to deploy it and practice

  • @tn5848
    @tn5848 5 หลายเดือนก่อน

    Is this a CTF machine or anything else?

  • @topegpt
    @topegpt ปีที่แล้ว

    Could nod locate Gemfilr termux metasploit, help

  • @hack_well
    @hack_well ปีที่แล้ว

    Thank you for your walkthrough, May God bless you 🎭

  • @guyhavia1730
    @guyhavia1730 ปีที่แล้ว

    What is the ctf url?

  • @networkmastro1402
    @networkmastro1402 ปีที่แล้ว

    thanks this is good staff

  • @gashone
    @gashone ปีที่แล้ว

    awesome, more like this

  • @vq8gef32
    @vq8gef32 ปีที่แล้ว

    Hi , Is this machine on HTB? Or any where that I can try it?

    • @vq8gef32
      @vq8gef32 ปีที่แล้ว

      I used pwncat-cs for my HTB - better experience )

  • @ReligionAndMaterialismDebunked
    @ReligionAndMaterialismDebunked ปีที่แล้ว

    Yeah, I've heard of this system before by a Norwegian, or whatever ethical hacker dude. :3

  • @somerandomwithacat750
    @somerandomwithacat750 ปีที่แล้ว

    Is this a VM I can play?

  • @bhagyalakshmi1053
    @bhagyalakshmi1053 ปีที่แล้ว

    My my language mistake but understanding never to attending after understanding again to looking you have the never misunderstanding but health problems are also more patients also I will attend

  • @marccheat121
    @marccheat121 ปีที่แล้ว

    Can you share link vm or image to create this k8s lab ?

  • @craigblackie2034
    @craigblackie2034 ปีที่แล้ว

    There's a distinction between LFI and directory traversal - I don't believe what you had was LFI.

  • @zxc11118
    @zxc11118 ปีที่แล้ว

    Excellent!

  • @MP-wm9gb
    @MP-wm9gb ปีที่แล้ว

    Is Docker now really secured OR there is still a breach which allows container breakout/escape?

  • @cheick127
    @cheick127 ปีที่แล้ว

    A really good content

  • @ReligionAndMaterialismDebunked
    @ReligionAndMaterialismDebunked ปีที่แล้ว

    Early in the comments. Nice! 2 hours ago!

  • @liudvikasstankus
    @liudvikasstankus ปีที่แล้ว

    this is awesome

  • @triggerHLM
    @triggerHLM ปีที่แล้ว

    Isn't this example very constructed? In case somone exposes a shell direclty over a webinterface the game is over anyway.

  • @djmasnas
    @djmasnas ปีที่แล้ว

    There is no secure place in the world ! Relax and take it easy

  • @localhost69
    @localhost69 ปีที่แล้ว

    nice

  • @gawaderanjeetsandipdypit3167
    @gawaderanjeetsandipdypit3167 ปีที่แล้ว

    This guy beats Dev-ops Engineer

  • @মুহাম্মাদনায়ীম

    Many TH-cam videos I have seen. That didn't work at all...
    Professional, 100% working software suggestion for audio recovery from android internal storage is required, please.

    • @annorome
      @annorome ปีที่แล้ว

      Copy Cat

  • @Hackwraghav
    @Hackwraghav ปีที่แล้ว

    Ed Sheeran

  • @johnreinermarcos
    @johnreinermarcos ปีที่แล้ว

    Makdkd

  • @stefanosbek
    @stefanosbek ปีที่แล้ว

    Highly suggest "SteamCloud" on hack the box to those wanting to get their hands on a CTF such as the one in the video

  • @issamafifi5545
    @issamafifi5545 ปีที่แล้ว

    I have worked for Global Cyber Security Company for more than 8 months, what I learned form your video more than what I learned form all of them 😆😆😆 thank you John >> you_are_the_best.txt

  • @elchinefa9524
    @elchinefa9524 ปีที่แล้ว +2

    As a K8S Admin very happy to see this one. I would like to try it aswell. Which CTF was it? TryhackMe?