search

aquasecurity / kube-hunter

Hunt for security weaknesses in Kubernetes clusters
Apache License 2.0
4.67k stars 580 forks source link

Dependence on canhazip.com for external IPs fetch #235

Open RaitoBezarius opened 4 years ago

RaitoBezarius commented 4 years ago

What would you like to be added

Currently, in Discovery Hosts module, canhazip.com is used as an external service, it'd be interesting to add the possibility to replace it by another service (just provide a canhazip.com—compatible service or some modular way to have an "ExternalIPService" instance which can give your external IP address).

Why is this needed

In the same vein as #127 This is not a good idea to depend on an external service which could log the request made to it or some third-party sitting on the link could listen to this request (assuming DNS requests are clear and can be listened), so for a blackbox pentesting in a company, it could be detected.

iyehuda commented 4 years ago

I agree that modular external IP discovery would be helpful.

How do you think kube-hunter should choose its way of discovery? I find it a bit strange to configure it via CLI (i.e. --ip-discovery=canhaz.ip). It is more reasonable to have multiple (secure) providers in a pluggable and failover.

What do you think?

RaitoBezarius commented 4 years ago

I agree this is strange to configure this via CLI. But how would you configure the providers in this case? A config file? Or do we curate the best choices of providers?

iyehuda commented 4 years ago

I think it is better to curate our own sources rather then letting the user handle this. As discussed #277, I believe the only option the user should have is whether or not using external services.