kube-hunter
kube-hunter copied to clipboard
aquasecurity
Dependence on canhazip.com for external IPs fetch
What would you like to be added
Currently, in Discovery Hosts module, canhazip.com is used as an external service, it'd be interesting to add the possibility to replace it by another service (just provide a canhazip.com—compatible service or some modular way to have an "ExternalIPService" instance which can give your external IP address).
Why is this needed
In the same vein as #127 This is not a good idea to depend on an external service which could log the request made to it or some third-party sitting on the link could listen to this request (assuming DNS requests are clear and can be listened), so for a blackbox pentesting in a company, it could be detected.
I agree that modular external IP discovery would be helpful.
How do you think kube-hunter should choose its way of discovery?
I find it a bit strange to configure it via CLI (i.e. --ip-discovery=canhaz.ip).
It is more reasonable to have multiple (secure) providers in a pluggable and failover.
What do you think?
I agree this is strange to configure this via CLI. But how would you configure the providers in this case? A config file? Or do we curate the best choices of providers?
I think it is better to curate our own sources rather then letting the user handle this. As discussed #277, I believe the only option the user should have is whether or not using external services.