peirates

No entries match these filters. Clear filters

1. v1.1.34 Oct 14, 2026 · issue 109

   Peirates v1.1.34 adds kubectl auth checking across all tokens, Azure IMDS identity harvesting, and a JSON pretty-printer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1.34 https://github.com/inguardians/peirates.git
   # already have the repo? check out this version:
   $ git checkout v1.1.34

   └──▷ TRY IT
   Enumerate what every collected service account token and certificate is permitted to do in the cluster — useful after bulk token harvesting to find a privileged identity.
   copy

   $ kubectl-can-i

   Inspect a captured secrets or config JSON file with readable formatting during a post-exploitation review.
   copy

   $ json-cat

   • Adds kubectl-can-i command to check kubectl auth can-i permissions across all stored service account tokens and certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds json-cat command to pretty-print JSON files.
   • Adds gathering of Azure managed identity tokens from the Azure Instance Metadata Service (IMDS).

   3 details in Everything

2. docs update Oct 10, 2026 · issue 101

   Adds hostpid-ptrace-breakout command (Linux AMD64, experimental) to run one bounded host command via ptrace through a hostPID: true container.

   • New detectionAdds hostpid-ptrace-breakout command to run one operator-supplied command (/bin/sh -c) in the namespaces, credentials, and filesystem context of an explicitly selected disposable root process visible from a hostPID: true container, using PTRACE_SEIZE and PTRACE_INTERRUPT on Linux AMD64.
   • Supports piping input to hostpid-ptrace-breakout in direct module mode via peirates -c -m hostpid-ptrace-breakout, accepting PID, command, and PID-specific confirmation phrase (TRACE-DISPOSABLE-HOST-PROCESS-<PID>) from stdin.
   • Enforces a 30-second default command timeout and 1 MiB output limit for the host command executed by hostpid-ptrace-breakout, with command exit code and restoration/cleanup status (restored=true detached=true; output artifact removed=true) reported separately.

   3 details in Everything

3. docs update Oct 10, 2026 · issue 101

   Peirates adds a ptraceptraceA Linux (and BSD) system call that lets one process inspect and control another — reading registers, memory, and intercepting syscalls — giving debuggers and cyber tools a hook into live process execution.-based container escape technique as a single-command execution primitive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a container escape technique using ptrace that executes a single command on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

4. docs update Oct 10, 2026 · issue 101

   peirates v1.1.33 adds nodes/proxy exec functionality for Kubernetes lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds nodes-proxy-exec functionality to execute commands through the Kubernetes nodes/proxy API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. docs update Oct 10, 2026 · issue 101

   peirates docs add eight new commands covering ConfigMap credential scanning and multiple container/host escape techniques⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds scan-configmaps command to scan ConfigMaps for misplaced credentials⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds hostpid-breakout command to enter a node from a privileged hostPIDhostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node. container
   • Adds container-escape-scan command to scan for container escape prerequisites
   • Adds docker-socket-breakout command to enter a host through an exposed Docker socket
   • Adds hostroot-breakout command to chroot a shell into an already-mounted host root filesystem

   +3 more show less

   • Adds hostproc-core-pattern-breakout command to enter a host through a writable host core pattern
   • Adds hostpid-ptrace-breakout command to open an interactive shell through a disposable host process
   • Adds hostlog-symlink-read command to read one host file through a writable host-log mount

   8 details in Everything

6. docs update Oct 10, 2026 · issue 101

   Peirates gains container-escape modules, hostPIDhostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node. ptrace shell, core_pattern breakout, and ConfigMap identity scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds container escape assessment and breakout modules covering privileged hostPID, ptrace, and Docker socket techniques.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an interactive hostPID ptrace shell for container escape without requiring SYS_ADMIN.
   • Adds a hostproc core_pattern breakout module for escaping containers via /proc/sys/kernel/core_pattern.
   • Adds ConfigMap scanning to detect stored credentials and identities across the cluster.
   • Adds bounded host-log symlink read capability for reading host filesystem logs via symlink traversal.

   +2 more show less

   • Improves Docker socket breakout interaction flow.
   • Adds architecture-specific build targets for peirates.
   • Adds container escape assessment and breakout modules covering privileged hostPID, ptrace, and Docker socket techniques.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an interactive hostPID ptrace shell for container escape without requiring SYS_ADMIN.
   • Adds a hostproc core_pattern breakout module for escaping containers via /proc/sys/kernel/core_pattern.
   • Adds ConfigMap scanning to detect stored credentials and identities across the cluster.
   • Adds bounded host-log symlink read capability for reading host filesystem logs via symlink traversal.

   +1 more show less

   • Adds architecture-specific build targets for peirates.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The nodes proxy TLS default is changed to insecure — connections that previously used secure TLS by default will now skip verification unless explicitly overridden.
7. v1.1.32 Sep 10, 2026 · issue 070

   Peirates v1.1.32 adds four new container escape techniques and a scanner to detect which are available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1.32 https://github.com/inguardians/peirates.git
   # already have the repo? check out this version:
   $ git checkout v1.1.32

   • Adds docker-socket-breakout container escape that opens an interactive host-root shell when a Docker-compatible socket is accessible.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a container escape technique for when the node's root filesystem is mounted into the container.
   • Adds a container escape technique exploiting a writeable /proc/sys/kernel/core_pattern.
   • Adds a container escape technique when CAP_PTRACECAP_PTRACEA Linux capability that grants a process permission to use the ptrace syscall to inspect and control other processes, letting cyber tools perform debugging, memory inspection, or injection without running as full root. is available and the pod has hostPIDhostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node. set to true (amd64 only).
   • Adds a scanner that detects which of the four new container escape conditions are present and alerts accordingly.

   5 details in Everything

8. v1.1.31 Sep 4, 2026 · issue 064

   Peirates v1.1.31 adds a menu item to escape privileged containers sharing the host PID namespace.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1.31 https://github.com/inguardians/peirates.git
   # already have the repo? check out this version:
   $ git checkout v1.1.31

9. docs update Aug 31, 2026 · issue 060

   Peirates adds multi-architecture distribution builds via make dist with DIST_COMPRESS and DIST_ARCHES controls

   └──▷ TRY IT
   Build distribution archives for only ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. (e.g. to deploy peirates on a Raspberry Pi cluster) without compressing the output.
   copy

   $ DIST_ARCHES=arm64 DIST_COMPRESS=no make dist

   • Adds DIST_ARCHES=amd64 (and similar) environment variable to build a subset of architectures instead of all four.
   • Adds make build as an explicit target (in addition to the default build) to generate a statically linked Linux AMD64 executable in the repository root.

   2 details in Everything

10. docs update Aug 28, 2026 · issue 058

    Peirates adds multi-arch make dist builds with DIST_COMPRESS and DIST_ARCHES controls for Linux AMD64, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., and 386

    └──▷ TRY IT
    Build distribution archives for only ARM64 when targeting a specific cluster node architecture.
    copy

    $ make dist DIST_ARCHES=arm64

    Build uncompressed binaries for all architectures to inspect or repackage them yourself.
    copy

    $ make dist DIST_COMPRESS=no

    • Adds make dist target to build compressed Linux distribution archives for AMD64, ARM, ARM64, and 386, written to scripts/.
    • Adds DIST_COMPRESS=no environment variable to keep unpacked (uncompressed) binaries when building distributions.
    • Adds DIST_ARCHES=<arch> environment variable to build a subset of architectures (e.g. DIST_ARCHES=amd64).
    • Adds individual per-architecture targets such as make dist-arm64 for targeted distribution builds.

    4 details in Everything

11. v1.1.26 Apr 17, 2025 · release notes

    Peirates v1.1.26 adds detection of microk8s kubelet kubeconfig location.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.26 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.26

    • Detects microk8s kubelet kubeconfig location, expanding coverage to microk8s-based Kubernetes environments.

    1 detail in Everything

12. v1.1.22 May 30, 2024 · release notes

    peirates v1.1.22 adds file output for svc account token and general command outputs for post-processing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.22 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.22

    • Adds svc-account-token export to a file
    • Adds file output support for kubectl, curl, shell, and kubectl-try-all commands

    2 details in Everything

13. v1.14 Nov 5, 2023 · release notes

    Adds --verbose flag for debug output and ability to display stored service account token values.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.14

    • Adds -v / --verbose flag to enable DEBUG-level log messages
    • Enables displaying the plaintext values of stored service account tokens

    2 details in Everything

14. v1.1.13 Sep 4, 2023 · release notes

    v1.1.13 adds cloud provider auto-detection and pod service account parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.13 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.13

    • Added cloud provider detection capability
    • Added ability to parse the current pod's service account name from its JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.

    2 details in Everything

15. 1.1.11 May 17, 2023 · release notes

    Adds image building and K8S deployment functions from contributor.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.11 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout 1.1.11

    • Added image building and K8S deployment functions from @devsecfranklin
    • Added another kubelet kubeconfig file path and handled errors better

    2 details in Everything

16. v1.1.7-alpha Prerelease Nov 12, 2021 · release notes

    peirates v1.1.7-alpha adds CoreDNS wildcard SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. service discovery and one-shot menu items

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.7-alpha https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.7-alpha

17. v1.1.5 Oct 8, 2021 · release notes

    v1.1.5 adds improved secret naming via node etc-hosts, deduplication of service accounts, and multi-command support in the CLI shell.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.5 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.5

    └──▷ TRY IT
    Pass multiple commands to a target pod's shell in a single invocation.
    copy

    $ peirates scan --shell "ls; whoami"

    • Adds pod's etc-hosts file to improve naming of secrets found on nodes
    • Eliminates duplicate service accounts from kubelet secret gathering
    • Enables passing multiple commands to the shell subcommand

    3 details in Everything

18. 1.1.14 Oct 7, 2021 · release notes

    Peirates v1.1.14 adds token value display and verbose debug logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.14 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout 1.1.14

    └──▷ TRY IT
    Inspect the contents of stored service account tokens for auditing or debugging.
    copy

    $ peirates tokens --display-values

    Increase log verbosity to view DEBUG-level messages for troubleshooting.
    copy

    $ peirates scan -v

    • Added capability to display the values of stored service account tokens
    • Added -v flag to display additional DEBUG messages

    2 details in Everything

19. v1.1.1 Oct 5, 2021 · release notes

    peirates v1.1.1 adds interactive shell and kubectl subcommands to the main menu

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    └──▷ USE IT
    Run a shell command directly from the peirates main menu without exiting.
    shell copy

    shell ls -la /tmp

    Execute kubectl against all namespaces from within the peirates menu.
    shell copy

    kubectl get pods --all-namespaces

    • Adds shell <command> [args] as a main menu entry to execute shell commands from within peirates
    • Adds kubectl [args] as a main menu entry to run kubectl commands without leaving peirates
    • Improves the kubectl menu command by allowing namespace override via -n or --all-namespaces flags

    3 details in Everything

20. 1.1.0 Oct 3, 2021 · release notes

    Peirates 1.1.0 enables standalone execution and adds automatic kubelet cert/key and pod secret discovery from node filesystem.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.0 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout 1.1.0

    • peirates binary can now be executed directly on the host without requiring a Kubernetes Pod environment
    • Automatic discovery of kubelet certificate and key pairs from the local node filesystem
    • Automatic enumeration of pod secrets located on the node filesystem

    3 details in Everything

21. 1.0.36 Oct 3, 2021 · release notes

    Peirates v1.0.36 auto-detects kubelet certs on-node and simplifies API URL via single -u flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.36 https://github.com/inguardians/peirates.git
    # already have the repo? check out this version:
    $ git checkout 1.0.36

    └──▷ TRY IT
    Connect to an external API server using a single URL flag
    copy

    $ peirates --auth-file=/path/to/token -u https://k8s-api.example.com:6443

    • Auto-detection of kubelet certificates when Peirates is run directly on a Kubernetes node.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -i and -p flags for specifying the API server IP/name and port are removed; use -u instead.