# Kube Hunter

> Use for Kubernetes exposure and attack-surface review during authorized pentests. Trigger on cluster endpoint discovery, Kubernetes service exposure analysis, and validating whether a cluster presents remotely reachable weaknesses.

- Skill: `timsonner/kube-hunter` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/kube-hunter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/kube-hunter/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/kube-hunter

---


# Kube-hunter

## Purpose

Use this skill for Kubernetes exposure review when the engagement needs to understand whether a cluster exposes risky services or endpoints.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to assess remotely reachable Kubernetes exposure.
- Need to review cluster attack surface in a structured way.
- Need a repeatable retest after exposure reduction.

## Avoid When

- The cluster is out of scope.
- In-cluster or active modes are not explicitly approved.

## Inputs

- Approved cluster endpoint or IP
- Allowed mode, preferably remote and low impact
- Output handling requirements

## Procedure

1. Start with remote or low-impact assessment modes.
2. Review only findings that materially expand attack surface.
3. Manually confirm important issues before escalation.
4. Correlate findings with cluster role and business context.
5. Preserve the exact mode and target for retest.

## Command Syntax

Replace sample targets with approved in-scope values.

```bash
# Passive scan against a remote API server
kube-hunter --remote 10.10.10.100

# Scan a CIDR range for Kubernetes components
kube-hunter --cidr 10.10.10.0/24

# Output to JSON
kube-hunter --remote 10.10.10.100 --report json > contoso-kube-hunter.json

# Active hunting (may create containers — requires explicit approval)
kube-hunter --active --remote 10.10.10.100

# Hunt from inside a running pod
kube-hunter --pod
```

## Evidence to Capture

- Remotely reachable Kubernetes exposure
- Exact cluster endpoint and mode used
- Findings that materially change cluster risk

## Safety Boundaries

- Prefer remote, low-impact assessment modes.
- Use more invasive modes only with explicit written approval.