CDK
Apache-2.0๐ฆ Container Security ยท Go
CDK (Container penetration toolkit) is an open-source tool designed for container environment penetration testing and exploitation. It's distributed as a single static binary with zero dependencies, making it easy to deploy inside target containers during red team engagements. CDK bundles three categories of functionality: evaluation (gathering container environment information, checking capabilities, and identifying potential escape vectors), exploitation (automated container escape using techniques like mounting host filesystems, exploiting Docker socket, abusing Linux capabilities, and leveraging kernel vulnerabilities), and tools (network scanning, file transfer, reverse shell, and other post-exploitation utilities). CDK is regularly updated with new escape techniques as they're discovered, making it the most comprehensive container escape toolkit available.
Installation
Download
$ Download static binary from GitHub releasesfrom source
$ git clone https://github.com/cdk-team/CDK.git && cd CDK && makeUse Cases
- Evaluating container security posture by checking capabilities and mounts
- Automated container escape via Docker socket, host mounts, and kernel exploits
- Post-exploitation inside containers including network scanning and file transfer
- Red team operations targeting containerized environments and Kubernetes clusters
- Testing container isolation and security boundaries during penetration tests
Tags
Details
- Category
- ๐ฆ Container Security
- Language
- Go
- Repository
- cdk-team/CDK
- License
- Apache-2.0
- Platforms
- ๐งlinux
Links
Alternatives & Comparisons
Falco
C++Cloud-native runtime security. Detects threats in containers, Kubernetes, and Linux hosts using system call monitoring and custom rules.
Compare CDK vs Falcokube-hunter
PythonKubernetes penetration testing tool. Hunts for security weaknesses in Kubernetes clusters from inside or outside the network.
Compare CDK vs kube-hunterDeepce
ShellDocker enumeration and privilege escalation. Discover Docker containers, check for misconfigurations, and find escape paths.
Compare CDK vs DeepceMore in Container Security
Falco
C++Cloud-native runtime security. Detects threats in containers, Kubernetes, and Linux hosts using system call monitoring and custom rules.
kube-hunter
PythonKubernetes penetration testing tool. Hunts for security weaknesses in Kubernetes clusters from inside or outside the network.
Deepce
ShellDocker enumeration and privilege escalation. Discover Docker containers, check for misconfigurations, and find escape paths.
Dockle
GoContainer image linter. Checks Docker images for security best practices, CIS benchmarks, and Dockerfile misconfigurations.
Syft
GoSoftware Bill of Materials generator. Creates SBOMs from container images and filesystems in SPDX and CycloneDX formats.