Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add flag to hide sensitive data in results output #531

Open
Voyen opened this issue Dec 13, 2022 · 0 comments
Open

Add flag to hide sensitive data in results output #531

Voyen opened this issue Dec 13, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@Voyen
Copy link

Voyen commented Dec 13, 2022

What would you like to be added

Add a flag (possibly --sensitive or --hide-sensitive) which would obfuscate any potentially sensitive data in the result outputs.
Enabling this flag would either hide the sensitive data completely (i.e. token 'eyJhbGciOiJSUzI1NiIs...' would become '******'), or partially hide it by showing the first n chars (i.e. 'eyJhbGciOiJSUzI1NiIs...' would become 'eyJhbG******').

Why is this needed

The vulnerability results output includes potentially sensitive data in some cases which would be exposed when kube-hunter runs.
For example issue KHV050 (Read access to pod's service account token) displays the full token in the 'evidence' field.
In most scenarios this token was previous relatively sensitive, however this scan output would now expose this token as plaintext in the kube-hunter logs.
Say you're a developer who doesn't have access to retrieve this token by any means, but you have access to get logs from a pod. Now you have access to something you shouldn't by reading these logs.

@Voyen Voyen added the enhancement New feature or request label Dec 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant