skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-docker-registry

Tests Docker Registry services for unauthenticated access, secret extraction, and image backdooring.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#container security#supply chain#docker registry#secret extraction#image backdooring#port 5000
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-docker-registry
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-docker-registry
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-docker-registry
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-docker-registry

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, Docker Registry services on port 5000 are often misconfigured with unauthenticated access, weak basic auth, or open push permissions, yet testers frequently miss these issues because the registry is just an HTTP API. This Skill provides a structured methodology to enumerate, exploit, and prove Docker Registry exposures.

Core Features & Use Cases

  • Registry Enumeration: Fingerprint the /v2/ API, determine HTTP vs HTTPS, and list repositories via /v2/_catalog with or without credentials.
  • Secret Extraction from Image Layers: Download and unpack blobs to recover source code, .env files, configs, and credentials baked into image layers.
  • Supply-Chain Backdoor Testing: With write access, push poisoned images (e.g., WordPress webshell or SSH images) to demonstrate downstream impact.
  • Use Case: During an authorized engagement, nmap shows 5000/tcp open as a Docker Registry; you confirm unauthenticated catalog access, pull the wordpress image, and extract wp-config.php database credentials from its layers.

Quick Start

Ask the AI to enumerate the Docker Registry at the target IP on port 5000 and check whether /v2/_catalog is accessible without authentication.

Frequently Asked Questions about pentesting-docker-registry

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate a Docker Registry on port 5000?▼

Enumerate a Docker Registry by querying its /v2/ API with curl: GET /v2/ returns {}, and GET /v2/_catalog returns the repository list or an UNAUTHORIZED error. First determine whether the service uses HTTP or HTTPS, then list tags and manifests per repository.

How to extract secrets from Docker Registry image layers?▼

Download blobs via /v2/<repo>/blobs/sha256:<digest> with curl, then unpack each blob with tar -xf in its own folder to avoid overwrites. Layers often contain source code, .env files, configs, and credentials. Alternatively use docker pull and docker history to inspect layers.

What tools can dump a Docker Registry with authentication?▼

DockerRegistryGrabber (drg.py) can list and dump registry images with or without basic auth, using flags like -U user -P pass and --dump_all. If basic auth is required, brute force it first with tools like Hydra, then re-enumerate with the recovered credentials.

Can a writable Docker Registry be used for supply-chain attacks?▼

Yes, if push access is allowed, an attacker can backdoor an existing image and push it so every downstream docker pull executes the payload. Examples include adding a PHP webshell to a WordPress image or enabling root SSH login in an SSH image.

Why does /v2/_catalog return UNAUTHORIZED on a Docker Registry?▼

The UNAUTHORIZED JSON error means the registry requires authentication, typically basic auth or a bearer token. Provide credentials with curl -u user:pass or a token header, or attempt to brute force weak basic-auth credentials before enumerating.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.7k

nmap-scan

Performs port scanning, service version detection, and NSE script scanning with nmap.

Official
Intermediate
utsavthakurutsavthakur

linux-lateral-movement

Perform Linux lateral movement via SSH, credential harvesting, and pivoting.

Community
Advanced
resultakakresultakak

secure-deployment-review

Review container deployments for security across images, Kubernetes, and CI/CD.

Community
Advanced
modu-aimodu-ai
1.2k

moai-ref-secops

Provides defensive security reference for CI/CD pipelines, containers, Kubernetes, and production APIs.

Official
Advanced