CDK is a container penetration toolkit designed for security testing of Kubernetes, Docker, and Containerd environments.
CDK addresses the challenge of performing security assessments within slimmed-down containers that lack standard OS tools and dependencies. It works by bundling exploitation capabilities and diagnostic tools into a single zero-dependency binary that can be deployed directly into a target container. The toolkit operates through three core modules: an Evaluate module that gathers information about the container environment and identifies potential weaknesses, an Exploit module that provides proof-of-concept and working exploits for container escape and lateral movement, and a Tool module offering network utilities and Kubernetes cluster management capabilities. Users run `cdk eva` to assess the environment and receive exploit recommendations, then execute `cdk run` to deploy the chosen attack.
The tool suits penetration testers and security researchers conducting authorized assessments of containerized infrastructure. It is particularly valuable in scenarios where the target container has minimal tooling available, making traditional penetration testing approaches difficult. The Evaluate module covers information gathering across system basics, Linux capabilities, mounts, network namespaces, sensitive environment variables, processes, local files, and Kubernetes API discovery. The Exploit module provides working attacks for container escape and cluster takeover. CDK distinguishes itself by requiring no external dependencies and being deliverable as a single binary, making it practical for real-world penetration testing where file upload or remote code execution may be the only initial access vector.
The project maintains active development with regular updates to exploit modules and evaluation capabilities. The codebase shows consistent refinement of existing features and addition of new exploitation techniques. Documentation is comprehensive, with detailed wiki pages covering each evaluation check and exploit scenario. The project demonstrates responsiveness to the container security landscape through ongoing additions to its exploit library.
