OWASP EKS Goat

OWASP EKS Goat is a hands-on AWS EKS security lab that teaches real-world attack and defense techniques for AWS managed Kubernetes clusters.

The lab simulates realistic attack paths and defense mechanisms including misconfigured IAM roles, IRSA abuse, ECR image backdooring, RBAC privilege escalation, and pod-to-node breakout. Participants walk through both the offensive and defensive scenarios.

Attack Scenarios (includes CVE-2024-23897):

Exploit Jenkins CVE to leak IAM credentials via IMDSv2.
Backdoor ECR images using leaked credentials.
Deploy compromised image into the EKS cluster.
Escalate privileges and breakout from pod to EC2 node.
Abuse IAM roles to exfiltrate data from S3.

Defense Scenarios:

Audit cluster state using Kubescape, Kubebench, and Hadolint.
Implement Pod Security Context and enforce policies with Kyverno (CEL).
Detect runtime behavior with eBPF-based Tetragon.
Scan and lock down ECR repositories.
Integrate AWS GuardDuty for monitoring.

View on GitHub Documentation

About OWASP EKS Goat

Lab Documentation

• Full walkthrough: https://eksgoat.kubernetesvillage.com • Alternate Link In case of accessibility issues, use: https://ekssecurity.netlify.app/ • In case of accessibility issues, use: https://ekssecurity.netlify.app/

Container & Image Security

• Docker Image and Layer Analysis • Container Secrets Misuse • Static Scanning with Hadolint, Dockle • Docker Bench Security (CIS benchmark)

AWS ECR Exploitation

• ECR Image Scanning • Immutable Tag Enforcement • Credential Abuse for Private ECR Enumeration • Backdooring Docker Images in ECR

AWS EKS Exploitation

• Deploying Vulnerable EKS Infrastructure • Metadata Service Abuse (IMDSv2) to Steal Credentials • Web App Exploitation to AWS IAM Compromise • ECR to EKS Cluster Compromise • Pod-to-Node Breakout in EKS • Privilege Escalation to S3 Access and Data Exfiltration • EC2 Instance Cleanup Post Exploit

Scanning & Auditing

• Kubescape for Compliance Assessment • Kubebench for Node Security Benchmarking • Hadolint for Dockerfile Linting

Runtime Defense & Hardening

• Pod Security Context Enforcement • Kyverno (CEL) Policy Enforcement in EKS • Real-time Runtime Detection via eBPF Tetragon • AWS GuardDuty Alerts for EKS Threats

Environment Lifecycle

• Infra Spin-up for Vulnerable EKS Cluster • Complete Infra Teardown Lab

RoadMap

• Current State: Created and open-sourced hands-on labs for AWS EKS misconfigurations and vulnerabilities. Developed detailed documentation to accompany lab walkthrough and theoretical concepts. Implementation of initial attack & defense scenarios with IAM and Kubernetes RBAC. Continue using mdbook for documentation. • Created and open-sourced hands-on labs for AWS EKS misconfigurations and vulnerabilities. • Developed detailed documentation to accompany lab walkthrough and theoretical concepts. • Implementation of initial attack & defense scenarios with IAM and Kubernetes RBAC. • Continue using mdbook for documentation. • Short-Term Goals: Transition existing infrastructure deployment scripts to Terraform. Update documentation to include images and step-by-step instructions for each lab. Expand the defensive scenarios, adding advance topics such as network policies. Add quizes for interaction. • Transition existing infrastructure deployment scripts to Terraform. • Update documentation to include images and step-by-step instructions for each lab. • Expand the defensive scenarios, adding advance topics such as network policies. • Add quizes for interaction. • Long-Term Objectives: Establish a continuous integration/continuous deployment (CI/CD) pipeline to automate the deployment and teardown of lab environments. Develop a community forum to facilitate participant interaction, knowledge sharing, and collaborative learning. Integrate threat modeling lab for AWS EKS infrastructure using EKS Goat to detect and mitigate proactively. • Establish a continuous integration/continuous deployment (CI/CD) pipeline to automate the deployment and teardown of lab environments. • Develop a community forum to facilitate participant interaction, knowledge sharing, and collaborative learning. • Integrate threat modeling lab for AWS EKS infrastructure using EKS Goat to detect and mitigate proactively.

Project Resources

Project Leaders

Divyanshu Shukla

Project lead

Senior security engineer experienced in Cloud Security, Kubernetes Security, DevSecops, Web Application Pentesting, and Threat Modelling. Reported multiple vulnerabilities to companies like Airbnb, Google, Microsoft, AWS, Apple, Amazon, Samsung, Zomato, Xiaomi, Alibaba, Opera, Protonmail, Mobikwik, etc, and received CVE-2019-8727 CVE-2019-16918, CVE-2019-12278, CVE-2019-14962 for reporting issues. Currently co-lead of OWASP EKS Goat, OWASP GKE Goat, Author of Burp-o-mation and a very-vulnerable-serverless application. Also part of AWS Community Builder for security and Defcon Cloud Village crew member 2020/2021/2022. Delivered talks at events like Blackhat Europe, Seasides, C0c0n, Nullcon, Brucon, Bsides Bangalore and Bsides Ahmedabad. Also winner of "Cybersecurity samurai 2023" at Bsides Bangalore 2023 & "Cloud Security Champion'' at CSA Bangalore 2023. Reach out at peachycloudsecurity[dot]com

Email Social

Anjali Shukla

Project lead

Anjali is a seasoned cloud security engineer experienced in DevSecOps and Kubernetes security (EKS/GKE) as well as AWS, Azure, and GCP security. She is the founder of Container Security Village and Kubernetes Village, communities dedicated to enhancing cloud-native security. As the project lead for OWASP EKS Goat, she focuses on AWS EKS security research and hands-on exploitation paths. Anjali is a recognized AWS Community Builder and actively shares her research through her YouTube channel, @peachycloudsecurity. Her extensive speaking history includes Black Hat Spring USA, Black Hat Europe, Nullcon, Seasides Goa, BSides Bangalore, CSA Bangalore, and C0c0n. She has also contributed to the community by volunteering at Cloud Village at DEF CON and various BSides events globally.Reach out at peachycloudsecurity[dot]com

Email Social

Project Information

Incubator Project

Classification

Other

Language

Shell

License

GNU General Public License v3.0

Contributors

GitHub Stars

Downloads

Corporate Supporters

Become a Corporate Supporter Meet our Corporate Supporters Supporter Job Postings

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.