Docker Registry Pentesting
Last modified: 2024-02-08
Docker Registry is a steteless, highly scalable server side application that stores and lets you distribute Docker images. A default port is 5000.
Endpoints
/v2/_catalog
/v2/<repository>/tags/list
# We can download the manifest given tag.
/v2/<repository>/manifests/<tag>
Extract Layers
If we download the manifest with the above, see the content and blobsums (sha256:abcd...) in fsLayers.
curl -so 1.tar https://example.com:5000/v2/<repository>/blobs/sha256:abcd...
tar -xvf 1.tar
After extracting tar files, investigate files or directories to find the sensitive information.