Support reverse lookup bruteforce about k8s-security HOT 4 CLOSED

https://twitter.com/mauilion/status/1025160250880454656?s=20

Neat feature of the default
@corednsio Deployment in Kubernetes

enumerate all svcs and ports in any namespace
$ dig SRV +short any.svc.cluster.local
0 16 443 kubernetes.default.svc.cluster.local.
0 16 80 web.web.svc.cluster.local.
0 16 80 web.default.svc.cluster.local.

The ports are only as valid as the services exposing them but yeah

from k8s-security.

@mauilion Wow, big thanks!

from k8s-security.

@mauilion Checking it on k8s 1.16, any.svc.cluster.local syntax is no longer working. A replacement is *.*.svc.cluster.local:

root@nginx-deployment-65cf964c9-5dlkr:/# dig SRV +short *.*.svc.cluster.local
0 14 443 kubernetes.default.svc.cluster.local.
0 14 53 kube-dns.kube-system.svc.cluster.local.
0 14 9153 kube-dns.kube-system.svc.cluster.local.
0 14 80 ingress-nginx.ingress-nginx.svc.cluster.local.
0 14 443 ingress-nginx.ingress-nginx.svc.cluster.local.
0 14 80 nginx-svc.default.svc.cluster.local.

from k8s-security.

No need to bruteforce services, since we can get them using the method above

from k8s-security.