githubEdit

Docker Registry

Tools: Postman, Insomnia, Browsers, drg.py https://github.com/Syzik/DockerRegistryGrabber

Default port: 5000 (Not always the case)

Docker registries are JSON endpoitns, so the interaction is quite different from a normal website.

REPOSITORY DISCOVERY

We may find plain text credentials or any other sensitive information of outdated repositories that haven't been taken down yet. So we can just get them via a GET request.

EXAMPLE:

1) List repositories

curl http://IP_ADDRESS:5000/v2/_catalog 

2) List manifests

curl http://IP_ADDRESS:5000/v2/REPOSITORY/tags/list 

3) Pull the manifests for the image

On step 3 you can also check for any clear-text credentials for a database or ssh etc.

4) Pull all layers of the image and save them in the form of .tar file

5) Decompress the file to see the contents

Last updated