Kubernetes security testing that an agent can actually run

[Dark-Moon-X]

Container and Kubernetes attack surface is large and easy to misconfigure. Darkmoon brings the same autonomous, evidence backed approach to K8s.

The K8s surface. RBAC, service accounts, exposed dashboards, privileged pods and cloud metadata all combine into attack paths that are tedious to check by hand.

Autonomous enumeration. Darkmoon enumerates the cluster, reasons about escalation paths and executes real checks, then records what it found and how.

Pivots that cross boundaries. The interesting findings are the ones that cross from a pod into the node, the cloud account or the internal network. The agent follows those chains.

Proof for every issue. As everywhere in Darkmoon, each K8s finding carries the command and output that proves it.

Point it at Kubernetes Goat to see the container and K8s coverage.

Docs: https://docs.dark-moon.org/ | Demo: https://youtu.be/1bFRVuMkZzY

What would you want to see next, and where do you think this approach breaks? Feedback welcome.