$ show cdk-team/CDK
CDK (Container Docker/Kubernetes Exploitation Toolkit) is a Go-based CLI penetration testing tool designed for container and Kubernetes environments. It evaluates security posture by running extensive checks against container runtime configurations, K8s API permissions, cloud metadata, and kernel exploit possibilities. It then executes a plethora of exploits covering container escape (cgroups, mount, eBPF, runc/containerd CVEs), K8s credential access (secrets, configmaps, tokens), persistence (backdoor daemonsets, cronjobs, shadow API server), privilege escalation (service account token theft, CVE-2026-31431), and remote control (reverse shells, kubelet exec). The binary bundles stripped-down versions of common tools (kubectl, netcat, vi, etc.) for post-exploitation use. The architecture follows a plugin pattern where exploits register themselves via init(), and evaluation uses a category-based check system. The codebase shows signs of organic growth with some legacy cruft (deprecated auto-escape task, commented-out code, future-dated CVEs) and moderate technical debt (global mutable state, panics, outdated Go idioms), but remains functional and actively maintained for penetration testers and security researchers.
The LLM identified 4 files worth highlighting for reuse:
Defines the global exploit and task registries and a helper to list them. Exploits register via init() calls, making addition of new exploits trivially declarative. This pattern can be extracted for any Go application needing a plugin system with zero runtime configuration.
Provides a complete K8s API request helper that handles service account token loading (from files, environment, or mounted secrets) and can bypass authentication for anonymous endpoints. Reusable in any Go tool needing lightweight K8s API interaction without the full client-go dependency.
Implements a pure-Go netcat capable of both listening and connecting modes, with stdin/stdout relay and optional exec for reverse shells. The code is self-contained (no network library beyond standard library) and can be extracted for use in constrained environments where the real netcat is unavailable.
Implements an evaluation engine that runs registered checks organized by categories (basic, extended, additional). Checks are registered via simple function calls. This pattern is reusable for any system that needs to run a configurable set of verification or assessment tasks, such as compliance scanners or health checks.