diff --git a/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md b/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
index d8806904a9..bdb29e9b7f 100644
--- a/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
+++ b/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
@@ -1,8 +1,8 @@
# Kubernetes Enumeration
{% hint style="success" %}
-Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)
\
-Learn & practice GCP Hacking:
[**HackTricks Training GCP Red Team Expert (GRTE)**
](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)
\
+Learn & practice GCP Hacking:
[**HackTricks Training GCP Red Team Expert (GRTE)**
](https://training.hacktricks.xyz/courses/grte)
@@ -135,9 +135,11 @@ Having the token and the address of the API server you use kubectl or curl to ac
By default, The APISERVER is communicating with `https://` schema
+{% code overflow="wrap" %}
```bash
-alias k='kubectl --token=$TOKEN --server=https://$APISERVER --insecure-skip-tls-verify=true'
+alias k='kubectl --token=$TOKEN --server=https://$APISERVER --insecure-skip-tls-verify=true [--all-namespaces]' # Use --all-namespaces to always search in all namespaces
```
+{% endcode %}
> if no `https://` in url, you may get Error Like Bad Request.
@@ -221,7 +223,7 @@ kurl -i -s -k -X $'POST' \
{% endtab %}
{% endtabs %}
-Another way to check your privileges is using the tool: [**https://github.com/corneliusweig/rakkess**](https://github.com/corneliusweig/rakkess)****
+Another way to check your privileges is using the tool: [**https://github.com/corneliusweig/rakkess**](https://github.com/corneliusweig/rakkess)\*\*\*\*
You can learn more about **Kubernetes RBAC** in:
@@ -275,7 +277,7 @@ kurl -k -v https://$APISERVER/api/v1/namespaces/
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get secrets -o yaml
k get secrets -o yaml -n custnamespace
```
@@ -320,8 +322,8 @@ The deployments specify the **components** that need to be **run**.
{% tabs %}
{% tab title="kubectl" %}
-```
-.k get deployments
+```bash
+k get deployments
k get deployments -n custnamespace
```
{% endtab %}
@@ -339,7 +341,7 @@ The Pods are the actual **containers** that will **run**.
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get pods
k get pods -n custnamespace
```
@@ -358,7 +360,7 @@ Kubernetes **services** are used to **expose a service in a specific port and IP
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get services
k get services -n custnamespace
```
@@ -377,7 +379,7 @@ Get all the **nodes configured inside the cluster**.
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get nodes
```
{% endtab %}
@@ -395,7 +397,7 @@ kurl -v https://$APISERVER/api/v1/nodes/
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get daemonsets
```
{% endtab %}
@@ -413,7 +415,7 @@ Cron jobs allows to schedule using crontab like syntax the launch of a pod that
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get cronjobs
```
{% endtab %}
@@ -430,9 +432,8 @@ kurl -v https://$APISERVER/apis/batch/v1beta1/namespaces//cronjobs
configMap always contains a lot of information and configfile that provide to apps which run in the kubernetes. Usually You can find a lot of password, secrets, tokens which used to connecting and validating to other internal/external service.
{% tabs %}
-
{% tab title="kubectl" %}
-```
+```bash
k get configmaps # -n namespace
```
{% endtab %}
@@ -442,15 +443,25 @@ k get configmaps # -n namespace
kurl -v https://$APISERVER/api/v1/namespaces/${NAMESPACE}/configmaps
```
{% endtab %}
-
{% endtabs %}
+### Get Network Policies / Cilium Network Policies
+
+{% tabs %}
+{% tab title="First Tab" %}
+```bash
+k get networkpolicies
+k get CiliumNetworkPolicies
+k get CiliumClusterwideNetworkPolicies
+```
+{% endtab %}
+{% endtabs %}
-### Get "all"
+### Get Everything / All
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k get all
```
{% endtab %}
@@ -460,7 +471,7 @@ k get all
{% tabs %}
{% tab title="kubectl" %}
-```
+```bash
k top pod --all-namespaces
```
{% endtab %}
@@ -479,8 +490,6 @@ kubectl get pod [-n ] -o yaml
> `k get nodes --show-labels`
>
> Commonly, kubernetes.io/hostname and node-role.kubernetes.io/master are all good label for select.
->
-> [reference]: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
Then you create your attack.yaml file
@@ -541,8 +550,8 @@ Information obtained from: [Kubernetes Namespace Breakout using Insecure Host Pa
{% embed url="https://www.cyberark.com/resources/threat-research-blog/kubernetes-pentest-methodology-part-3" %}
{% hint style="success" %}
-Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)
\
-Learn & practice GCP Hacking:
[**HackTricks Training GCP Red Team Expert (GRTE)**
](https://training.hacktricks.xyz/courses/grte)
+Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)
\
+Learn & practice GCP Hacking:
[**HackTricks Training GCP Red Team Expert (GRTE)**
](https://training.hacktricks.xyz/courses/grte)