kube-hunter remote

kube-hunter --remote <k8s-api>

Scan a remote Kubernetes cluster (exposed API server) for vulnerabilities and misconfigurations, including unauthenticated access.

Run it when you find an exposed Kubernetes API server (Shodan: 6443, 10250) or one reachable from the internal network. kube-hunter tests anonymous API access, unauthenticated kubelet, exposed dashboards, and known CVEs, all in one pass.

The scan generates logs on the API server and nodes. If the cluster has Kubernetes auditing (apiserver audit log) or a WAF in front, the reconnaissance is logged with your IP. If you already have valid credentials, manual enumeration with kubectl is cleaner.