ENDPOINT_EXPLOIT
Represents a network endpoint exposed by a container that could be exploited by an attacker (via means known or unknown). This can correspond to a Kubernetes service, node service, node port, or container port.
| Source | Destination | MITRE ATT&CK |
|---|---|---|
| Endpoint | Container | Exploitation of Remote Services, T1210 |
Details
Exposed endpoints represent the most common entry point for attackers into a cluster.
Prerequisites
A network endpoint exposed by a container.
Checks
Endpoints exposed outside the cluster can be queried via kubectl:
Alternatively open ports can be discovered by traditional port scanning techniques or a tool like KubeHunter
Exploitation
This edge simply indicates that an endpoint is exposed by a container. It does not signal that the endpoint is exploitable but serves as a useful starting point for path traversal queries.
Defences
None