🧰 kubectl

The items that name it 10

• Five Kubernetes Security Gaps Attackers Chain Together
  article2026-10-02

  Used to run 'kubectl get clusterrole' as a quick check of resolved RBAC permissions on every role

• From Container Escape to Cloud Takeover
  writeup2026-07-26
• Unauthenticated RCE in ArgoCD
  writeup2026-07-11

  used to convert a malicious BadPods manifest YAML to JSON and to check applied NetworkPolicy objects

• Automating Penetration Testing with SecureCodeBox on Kubernetes (Kind) + GitHub Actions
  writeup2026-06-25It is written here as kubectl (v1.27.1): queries scan status and findings.

  v1.27.1

• Kogaro
  repo2026-06-25

  Used to inspect Kogaro deployment status, logs, and patch resources based on Kogaro findings

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeup2026-06-09

  Used by the malware for Kubernetes reconnaissance, secret dumping, and pod propagation; downloaded automatically by payload if not installed

• Observing Privilege Escalation in Kubernetes (EKS CloudWatch Observability Add-on)
  writeup2026-06-01

  Kubernetes CLI used throughout to interact with cluster, exploit RBAC permissions (auth whoami, get, edit, replace configmap), and exec into pods

• cks/tasks/cks/course/README.md at master · ViktorUJ/cks
  courseIt is written here as kubectl (cluster administration; kubectl auth can-i for RBAC checks).

  cluster administration; kubectl auth can-i for RBAC checks

• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  article

  Used by an EKS administrator to capture live context: RBAC roles/bindings, pod definitions, cluster events, ServiceAccounts; kubectl debug node used as last-resort node access

• AWS EKS Forensics: Data Sources and Investigation Tooling
  article

  Kubernetes CLI used with an EKS administrator account to capture live context: RBAC roles/bindings, pod definitions, cluster events, ServiceAccounts

In every workspace you can read 12