offsec notes
20.02.202515:50
Kubernetes security fundamentals
Introduction
API Security
Authentication
Authorization
Admission Control
Networking
Introduction
* Complications of talking about Kubernetes security
* Managed and unmanaged Kubernetes distributions
* Areas of discussion
API Security
* Kubernetes components and ports
- Unmanaged Kubernetes
- Managed Kubernetes
* Securing Kubernetes APIs
Authentication
* Kubernetes authentication principles
- Internal Kubernetes authentication methods
- Static token authentication
- Bootstrap tokens
- X.509 client certificates
- Service account tokens
* External authentication methods
- OpenID Connect (OIDC)
- Webhook token authentication
- Authenticating proxy
- Impersonating proxy
* Authentication for other Kubernetes components
- Kubelet
- Controller manager and scheduler
- Kube-proxy
- Etcd
Authorization
* Kubernetes authorization principles
* Kubernetes authorization modules
- AlwaysAllow and AlwaysDeny
- Node Authorizer
- ABAC
- RBAC
- Webhook
* Authorization for other Kubernetes components
- Kubelet
- Scheduler and Controller Manager
Admission Control
* Admission control overview
- Internal admission controllers
- External admission controllers
* Risks of implementing external admission control
- Using admission control for pod security
Networking
* Network trust zones
* Introduction to CNI
* Managing network access in Kubernetes
* Securing the cluster network
* Conclusion
* Appendix - Setting up a demonstration environment
05.02.202516:42
Keycloak pentest
Articles
Part 1 - Link
Part2 - Link
* Additional Services and Ports
* Interesting Local Files
* Reconnaissance Conclusion
Exploitation
* Brute Force Login
* Bypassing/Automating CSRF
* JWT Signing Algorithms
* Make the most out of your scopes/roles
* offline_access
* uma_authorization
* profile
* email
* address
* phone
Tools
Keycloak security scanner - Link
* Начиная с keycloak 17.0+ роут /auth в URL должен быть пропущен (
Articles
Part 1 - Link
* Am I Testing Keycloak?
* Keycloak Version Information
* OpenID Configuration /SAML Descriptor
* Realms (Enumeration && Self-Registration Enabled)
* Client IDs
* Scopes
* Grants
* Identity Providers
* Roles
* User Email Enumeration
Part2 - Link
Reconnaissance
* Additional Services and Ports
* Interesting Local Files
* Reconnaissance Conclusion
Exploitation
* Brute Force Login
* Bypassing/Automating CSRF
* JWT Signing Algorithms
* Make the most out of your scopes/roles
* offline_access
* uma_authorization
* profile
* address
* phone
Tools
Keycloak security scanner - Link
* Начиная с keycloak 17.0+ роут /auth в URL должен быть пропущен (
/realms/realm_name/)Показано 1 - 2 із 2
Увійдіть, щоб розблокувати більше функціональності.