Kubernetes Security Scanner
#!/usr/bin/env python3

import nmap
import kubernetes
import json
import requests

scanner = nmap.PortScanner()
client = kubernetes.client.CoreV1Api()
nodes = client.list_node()

def check_nvd(ip):
    nvd_url = "https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&query={}"
    
    response = requests.get(nvd_url.format(ip))
    
    if response.status_code == 200:
        html = response.text
        
        start = html.find("vuln-matching-records-count")
        end = html.find("</strong>", start)
        count = html[start + 28:end]
        
        print(f"NVD vulnerabilities found: {count}")
        
        start = html.find("<table id=\"vuln-results-table\"")
        end = html.find("</table>", start)
        table = html[start:end + 8]
        
        print(table)
    else:
        print(f"Error: Could not connect to the NVD Vulnerability Scanner. Status code: {response.status_code}")

for node in nodes.items:
    node_name = node.metadata.name
    node_ip = node.status.addresses[0].address
    
    print(f"Scanning node {node_name} with IP {node_ip}")
    
    scanner.scan(node_ip, '1-65535')
    
    scan_results = scanner[node_ip]
    
    if scan_results['tcp']:
        print(f"Open ports: {scan_results['tcp'].keys()}")
        
        for port in scan_results['tcp'].keys():
            port_state = scan_results['tcp'][port]['state']
            port_service = scan_results['tcp'][port]['name']
            
            print(f"Port {port} is {port_state} and runs {port_service}")
            
            if port_service in ['telnet', 'ftp', 'ssh']:
                print(f"WARNING: Port {port} is running a potentially insecure service: {port_service}")
    else:
        print(f"No port is open on node {node_name}")
    
    check_nvd(node_ip)
    
    print("-" * 50)

scans/k8s_scan_01.py
gma1k/k8s-sec-scan
#!/usr/bin/env python3

import os
import subprocess
import json
import requests

KUBE_CONFIG = os.path.expanduser("~/.kube/config")

KUBESCAPE_OUTPUT = "kubescape_output.json"
CHECKOV_OUTPUT = "checkov_output.json"
NVD_OUTPUT = "nvd_output.json"
NMAP_OUTPUT = "nmap_output.json"

NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/1.0"
NVD_PARAMS = {
    "keyword": "kubernetes",
    "resultsPerPage": 100
}

NMAP_CMD = "nmap"
NMAP_PARAMS = [
    "-p", "1-65535",
    "-sV",
    "-oX", NMAP_OUTPUT
]

os.system("curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh | /bin/bash")
os.system("pip install checkov")
os.system("apt-get install nmap")

os.system(f"kubescape scan framework nsa --output json > {KUBESCAPE_OUTPUT}")

os.system(f"checkov -d . --output json --framework kubernetes > {CHECKOV_OUTPUT}")

response = requests.get(NVD_API_URL, params=NVD_PARAMS)
if response.status_code == 200:
    data = response.json()
    with open(NVD_OUTPUT, "w") as f:
        json.dump(data, f, indent=4)
else:
    print(f"Error: NVD API request failed with status code {response.status_code}")

with open(KUBE_CONFIG, "r") as f:
    config = json.load(f)
    cluster_ip = config["clusters"][0]["cluster"]["server"].split("//")[1].split(":")[0]

os.system(f"{NMAP_CMD} {' '.join(NMAP_PARAMS)} {cluster_ip}")

print("Kubernetes Security Scan Results:")
print(f"Kubescape output file: {KUBESCAPE_OUTPUT}")
print(f"Checkov output file: {CHECKOV_OUTPUT}")
print(f"NVD output file: {NVD_OUTPUT}")
print(f"Nmap output file: {NMAP_OUTPUT}")

scans/k8s_scan_02.py
gma1k/k8s-sec-scan