Escalate privileges through RBAC and service account tokens
Kubernetes RBAC is the primary gatekeeper for cluster access, yet misconfigurations remain one of the most common attack vectors in production environments. Our labs walk your team through real-world privilege escalation scenarios exploiting overly permissive ClusterRoleBindings, service account token abuse, and namespace escape techniques. Learners gain practical skills in auditing RBAC policies, implementing least-privilege roles, securing service account tokens, and detecting unauthorized access patterns across multi-tenant clusters.
Break out of containers and harden pod security standards
Containers are the fundamental building blocks of Kubernetes workloads, and securing them requires understanding both build-time and runtime attack vectors. Our labs cover real container escape techniques exploiting privileged pods, hostPath mounts, and kernel vulnerabilities. Your team will learn to implement Pod Security Standards, scan images for vulnerabilities and embedded secrets, configure seccomp and AppArmor profiles, enforce read-only root filesystems, and detect anomalous container behavior at runtime using tools like Falco and Kubernetes audit logs.
Pivot from a pod into the cloud account behind the cluster
Kubernetes clusters rarely stand alone, and the highest-impact attack path runs from a single low-privileged pod into the cloud account behind the cluster. In hands-on labs your team reaches the Instance Metadata Service from a compromised pod, abuses IRSA, EKS Pod Identity, Fargate task credentials and workload identity federation, and turns service account tokens and node identity into real cloud credentials across EKS, GKE and AKS. From there they pivot out of the cluster to reach storage, secrets and other cloud services, exactly the chain that turns a container foothold into a full cloud compromise. Pwned Labs certifies this whole path in the Kubernetes Attack and Defense bootcamp, which leads to the KRTP certification.
Attack and enforce Kubernetes admission control
Admission control decides which workloads a cluster will run, which makes it both a defensive control and an attacker target. In hands-on labs your team sees how weak or missing admission control lets attackers deploy privileged pods, malicious operators and poisoned workloads, then writes and tests policies that stop them with OPA Gatekeeper and Kyverno. Learners enforce Pod Security Standards, restrict images to trusted registries, and work with mutating and validating webhooks from both sides, building a practical grasp of the admission-control and supply-chain gaps that let a single deployment compromise a cluster.
Detect and investigate cluster intrusions using audit logs
Build practical incident response skills for Kubernetes environments through labs covering audit log analysis, runtime threat detection with Falco and Tetragon, and forensic investigation of compromised clusters. Learn to configure centralized logging with Fluentd and Loki, build alerting pipelines for suspicious API server activity, and perform post-incident forensics on container artifacts and etcd snapshots. Our scenarios simulate real breach patterns including cryptominer deployments, data exfiltration through DNS tunneling, and persistent backdoors via mutating webhooks, giving you the detection and response skills that matter in production. Pwned Labs pairs each attack lab with the corresponding defense, so your team sees both sides of the same technique.