kcatcher

Catch what's lurking in your Kafka clusters.

Introduction

Kcatcher is a command-line utility for enumerating and evaluating Kafka cluster configurations. It connects to Apache Kafka clusters and retrieves detailed information about brokers, topics, ACLs, and even samples messages. Perfect for security audits, infrastructure assessments, or just understanding what's running in your Kafka environment.

Demo

Installation

Go

If you have a functional Go environment, you can install with:

go install github.com/RoseSecurity/kcatcher@latest

Apt

To install packages, you can quickly setup the repository automatically:

curl -1sLf \
  'https://dl.cloudsmith.io/public/rosesecurity/kcatcher/setup.deb.sh' \
  | sudo -E bash

Once the repository is configured, you can install with:

apt install kcatcher

Source

git clone [email protected]:RoseSecurity/kcatcher.git
cd kcatcher
make build

Usage

Basic Enumeration

Connect to a Kafka cluster and retrieve broker and topic metadata:

kcatcher -b kafka-broker-1,kafka-broker-2

Custom Port

Specify a non-default Kafka port:

kcatcher -b kafka-broker-1 -p 9093

ACL Enumeration

Retrieve Access Control Lists configured on the cluster:

kcatcher -b kafka-broker-1 --acls

Message Sampling

Sample recent messages from a specific topic:

kcatcher -b kafka-broker-1 --sample-topic my-topic --sample-count 5

JSON Output

Output results in JSON format for further processing:

kcatcher -b kafka-broker-1 --acls -o json

Configuration Enumeration

Retrieve broker and topic configurations:

kcatcher -b kafka-broker-1 --configs

Security Analysis

Run a comprehensive security analysis on your Kafka cluster:

kcatcher -b kafka-broker-1 --analyze

Combine with ACL and configuration enumeration for a complete assessment:

kcatcher -b kafka-broker-1 --acls --configs --analyze

The security analysis evaluates your cluster against 20 built-in security rules across five categories: Authentication, Authorization, Encryption, Access Control, and Configuration. Results include a security score (0-100), letter grade, and detailed findings with remediation guidance.

Flags

Security Rules Reference

The security analysis engine evaluates your Kafka cluster against the following rules:

Authentication

Authorization

Encryption

Access Control (ACLs)

Configuration

Security Score

The analysis produces a security score from 0-100 and a letter grade:

Contributing

For bug reports & feature requests, please use the issue tracker.

PRs are welcome! We follow the typical "fork-and-pull" Git workflow.

1. Fork the repo on GitHub
2. Clone the project to your own machine
3. Commit changes to your own branch
4. Push your work back up to your fork
5. Submit a Pull Request so that we can review your changes

[!TIP] Be sure to merge the latest changes from "upstream" before making a pull request!

Many Thanks to Our Contributors