1"use strict";(self.webpackChunkhackviser_website=self.webpackChunkhackviser_website||[]).push([[4692],{61020:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>o,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>c,toc:()=>l});var s=t(17624),i=t(4552);const n={title:"Artifact Registry Pentesting",sidebar_label:"Artifact Registry",description:"Artifact Registry pentesting techniques for identifying, exploiting package and container registries, enumeration, attack vectors and post-exploitation insights.",tags:["Port 5000","Port 8081","Port 8082","Port 8443"]},a="Artifact Registry",c={id:"pentesting/services/artifact-registry",title:"Artifact Registry Pentesting",description:"Artifact Registry pentesting techniques for identifying, exploiting package and container registries, enumeration, attack vectors and post-exploitation insights.",source:"@site/tactics/pentesting/services/artifact-registry.md",sourceDirName:"pentesting/services",slug:"/pentesting/services/artifact-registry",permalink:"/tactics/pentesting/services/artifact-registry",draft:!1,unlisted:!1,tags:[{label:"Port 5000",permalink:"/tactics/tags/port-5000"},{label:"Port 8081",permalink:"/tactics/tags/port-8081"},{label:"Port 8082",permalink:"/tactics/tags/port-8082"},{label:"Port 8443",permalink:"/tactics/tags/port-8443"}],version:"current",frontMatter:{title:"Artifact Registry Pentesting",sidebar_label:"Artifact Registry",description:"Artifact Registry pentesting techniques for identifying, exploiting package and container registries, enumeration, attack vectors and post-exploitation insights.",tags:["Port 5000","Port 8081","Port 8082","Port 8443"]},sidebar:"pentestingSidebar",previous:{title:"ADB",permalink:"/tactics/pentesting/services/adb"},next:{title:"Consul",permalink:"/tactics/pentesting/services/consul"}},o={},l=[{value:"Connect",id:"connect",level:2},{value:"Using Docker CLI",id:"using-docker-cli",level:3},{value:"Using curl",id:"using-curl",level:3},{value:"Using Package Managers",id:"using-package-managers",level:3},{value:"Using skopeo",id:"using-skopeo",level:3},{value:"Recon",id:"recon",level:2},{value:"Service Detection with Nmap",id:"service-detection-with-nmap",level:3},{value:"Product Fingerprinting",id:"product-fingerprinting",level:3},{value:"Repository Path Discovery",id:"repository-path-discovery",level:3},{value:"Authentication Review",id:"authentication-review",level:3},{value:"Enumeration",id:"enumeration",level:2},{value:"Docker Registry Enumeration",id:"docker-registry-enumeration",level:3},{value:"Nexus Enumeration",id:"nexus-enumeration",level:3},{value:"Artifactory Enumeration",id:"artifactory-enumeration",level:3},{value:"Harbor Enumeration",id:"harbor-enumeration",level:3},{value:"Image Layer Review",id:"image-layer-review",level:3},{value:"Attack Vectors",id:"attack-vectors",level:2},{value:"Anonymous Read Access",id:"anonymous-read-access",level:3},{value:"Weak Credentials",id:"weak-credentials",level:3},{value:"Leaked Tokens",id:"leaked-tokens",level:3},{value:"Package or Image Push Abuse",id:"package-or-image-push-abuse",level:3},{value:"Sensitive Artifact Exposure",id:"sensitive-artifact-exposure",level:3},{value:"Post-Exploitation",id:"post-exploitation",level:2},{value:"Artifact Inventory",id:"artifact-inventory",level:3},{value:"Secret Review",id:"secret-review",level:3},{value:"CI/CD Pivot Review",id:"cicd-pivot-review",level:3},{value:"Useful Tools",id:"useful-tools",level:2},{value:"Security Misconfigurations",id:"security-misconfigurations",level:2}];function d(e){const r={code:"code",h1:"h1",h2:"h2",h3:"h3",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.M)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.h1,{id:"artifact-registry",children:"Artifact Registry"}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:(0,s.jsx)(r.code,{children:"Default Ports: 5000, 8081, 8082, 8443"})})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Artifact registries"})," store container images, packages, Helm charts, build outputs, and release files. In pentests, exposed registries can leak private images, packages, source archives, CI tokens, secrets in layers, and write paths for supply-chain abuse."]}),"\n",(0,s.jsx)(r.h2,{id:"connect",children:"Connect"}),"\n",(0,s.jsx)(r.h3,{id:"using-docker-cli",children:"Using Docker CLI"}),"\n",(0,s.jsx)(r.p,{children:"Use Docker to validate container registry read or write access."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"docker login registry.target.com\ndocker pull registry.target.com/project/image:tag\ndocker image inspect registry.target.com/project/image:tag\n"})}),"\n",(0,s.jsx)(r.h3,{id:"using-curl",children:"Using curl"}),"\n",(0,s.jsx)(r.p,{children:"Registry APIs are HTTP-based and easy to fingerprint."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -i https://registry.target.com/v2/\ncurl -I https://repo.target.com/\ncurl -I https://harbor.target.com/\n"})}),"\n",(0,s.jsx)(r.h3,{id:"using-package-managers",children:"Using Package Managers"}),"\n",(0,s.jsx)(r.p,{children:"Native package managers confirm real developer and CI access paths."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"npm ping --registry https://repo.target.com/repository/npm/\ncurl -I https://repo.target.com/repository/maven-public/\ncurl -I https://repo.target.com/repository/pypi/simple/\nhelm repo add target https://repo.target.com/chartrepo/project\nhelm search repo target\n"})}),"\n",(0,s.jsx)(r.h3,{id:"using-skopeo",children:"Using skopeo"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.code,{children:"skopeo"})," inspects remote images without pulling into Docker."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"skopeo inspect docker://registry.target.com/project/image:tag\nskopeo inspect --tls-verify=false docker://registry.target.com/project/image:tag\n"})}),"\n",(0,s.jsx)(r.h2,{id:"recon",children:"Recon"}),"\n",(0,s.jsx)(r.h3,{id:"service-detection-with-nmap",children:"Service Detection with Nmap"}),"\n",(0,s.jsx)(r.p,{children:"Scan common Nexus, Artifactory, Harbor, and Docker Registry ports."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"nmap -p 80,443,5000,5001,8081,8082,8083,8443,9000 -sV target.com\nnmap -p 80,443,5000,8081,8082,8443 --script http-title,http-headers target.com\nnmap -p 443,8443 --script ssl-cert,ssl-enum-ciphers target.com\n"})}),"\n",(0,s.jsx)(r.h3,{id:"product-fingerprinting",children:"Product Fingerprinting"}),"\n",(0,s.jsx)(r.p,{children:"Product type determines API paths and permission checks."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -I https://repo.target.com/service/rest/v1/status\ncurl -I https://repo.target.com/artifactory/api/system/ping\ncurl -I https://harbor.target.com/api/v2.0/systeminfo\ncurl -I https://registry.target.com/v2/\nhttpx -u https://repo.target.com -title -tech-detect -status-code\n"})}),"\n",(0,s.jsx)(r.h3,{id:"repository-path-discovery",children:"Repository Path Discovery"}),"\n",(0,s.jsx)(r.p,{children:"Repository names reveal package ecosystems and deployment flows."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -I https://repo.target.com/repository/maven-public/\ncurl -I https://repo.target.com/repository/npm-private/\ncurl -I https://repo.target.com/repository/pypi/simple/\ncurl -I https://repo.target.com/repository/docker-hosted/v2/\n"})}),"\n",(0,s.jsx)(r.h3,{id:"authentication-review",children:"Authentication Review"}),"\n",(0,s.jsx)(r.p,{children:"Compare anonymous, user, and CI token access."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -i https://registry.target.com/v2/\ncurl -u user:password -i https://registry.target.com/v2/\ncurl -H 'Authorization: Bearer TOKEN' -i https://registry.target.com/v2/\n"})}),"\n",(0,s.jsx)(r.h2,{id:"enumeration",children:"Enumeration"}),"\n",(0,s.jsx)(r.h3,{id:"docker-registry-enumeration",children:"Docker Registry Enumeration"}),"\n",(0,s.jsx)(r.p,{children:"Docker Registry API may expose catalogs and tags."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -s https://registry.target.com/v2/_catalog | jq\ncurl -s https://registry.target.com/v2/project/image/tags/list | jq\nskopeo inspect docker://registry.target.com/project/image:tag\n"})}),"\n",(0,s.jsx)(r.h3,{id:"nexus-enumeration",children:"Nexus Enumeration"}),"\n",(0,s.jsx)(r.p,{children:"Nexus REST APIs expose repositories, assets, components, and formats."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'curl -u user:password https://repo.target.com/service/rest/v1/repositories | jq\ncurl -u user:password "https://repo.target.com/service/rest/v1/search?repository=maven-public" | jq\ncurl -u user:password "https://repo.target.com/service/rest/v1/assets?repository=raw-hosted" | jq\n'})}),"\n",(0,s.jsx)(r.h3,{id:"artifactory-enumeration",children:"Artifactory Enumeration"}),"\n",(0,s.jsx)(r.p,{children:"Artifactory APIs reveal repositories, builds, and artifacts."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -u user:password https://repo.target.com/artifactory/api/repositories | jq\ncurl -u user:password https://repo.target.com/artifactory/api/system/ping\ncurl -u user:password https://repo.target.com/artifactory/api/search/artifact?name=*.jar | jq\n"})}),"\n",(0,s.jsx)(r.h3,{id:"harbor-enumeration",children:"Harbor Enumeration"}),"\n",(0,s.jsx)(r.p,{children:"Harbor APIs expose projects, repositories, tags, and robot accounts."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -s https://harbor.target.com/api/v2.0/projects | jq\ncurl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories | jq\ncurl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories/REPO/artifacts | jq\n"})}),"\n",(0,s.jsx)(r.h3,{id:"image-layer-review",children:"Image Layer Review"}),"\n",(0,s.jsx)(r.p,{children:"Image layers can contain secrets, configs, and build leftovers."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"docker pull registry.target.com/project/image:tag\ndocker save registry.target.com/project/image:tag -o image.tar\ntrufflehog filesystem image.tar\nsyft registry.target.com/project/image:tag\n"})}),"\n",(0,s.jsx)(r.h2,{id:"attack-vectors",children:"Attack Vectors"}),"\n",(0,s.jsx)(r.h3,{id:"anonymous-read-access",children:"Anonymous Read Access"}),"\n",(0,s.jsx)(r.p,{children:"Anonymous reads can expose private code, packages, and images."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -s https://registry.target.com/v2/_catalog | jq\ndocker pull registry.target.com/project/private-image:latest\nnpm view package-name --registry https://repo.target.com/repository/npm/\n"})}),"\n",(0,s.jsx)(r.h3,{id:"weak-credentials",children:"Weak Credentials"}),"\n",(0,s.jsx)(r.p,{children:"Registry accounts are often reused by CI and developers."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"docker login registry.target.com\ncurl -u user:password https://repo.target.com/service/rest/v1/repositories\n"})}),"\n",(0,s.jsx)(r.h3,{id:"leaked-tokens",children:"Leaked Tokens"}
1),"\n",(0,s.jsx)(r.p,{children:"Search CI configs and source repositories for registry credentials."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"rg -n 'docker login|NEXUS|ARTIFACTORY|HARBOR|REGISTRY|npm_token|_authToken' .\nrg -n 'password|token|apikey|secret' .github .gitlab-ci.yml Jenkinsfile Dockerfile\n"})}),"\n",(0,s.jsx)(r.h3,{id:"package-or-image-push-abuse",children:"Package or Image Push Abuse"}),"\n",(0,s.jsx)(r.p,{children:"Write access can allow package poisoning or image tampering."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"docker tag test-image registry.target.com/project/test-image:pentest\ndocker push registry.target.com/project/test-image:pentest\nnpm publish --registry https://repo.target.com/repository/npm-hosted/\n"})}),"\n",(0,s.jsx)(r.h3,{id:"sensitive-artifact-exposure",children:"Sensitive Artifact Exposure"}),"\n",(0,s.jsx)(r.p,{children:"Artifacts may include backups, source archives, SBOMs, configs, or logs."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'curl -u user:password "https://repo.target.com/service/rest/v1/search?name=backup" | jq\ncurl -u user:password "https://repo.target.com/service/rest/v1/search?name=config" | jq\ncurl -u user:password "https://repo.target.com/service/rest/v1/search?name=secret" | jq\n'})}),"\n",(0,s.jsx)(r.h2,{id:"post-exploitation",children:"Post-Exploitation"}),"\n",(0,s.jsx)(r.h3,{id:"artifact-inventory",children:"Artifact Inventory"}),"\n",(0,s.jsx)(r.p,{children:"Save repository, image, package, and tag listings as evidence."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"curl -u user:password https://repo.target.com/service/rest/v1/repositories > repositories.json\ncurl -s https://registry.target.com/v2/_catalog > registry-catalog.json\ncurl -s https://registry.target.com/v2/project/image/tags/list > image-tags.json\n"})}),"\n",(0,s.jsx)(r.h3,{id:"secret-review",children:"Secret Review"}),"\n",(0,s.jsx)(r.p,{children:"Review pulled artifacts and images for credentials."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"trufflehog filesystem extracted-artifacts/\ngitleaks detect --source extracted-artifacts/\nsyft registry.target.com/project/image:tag -o table\n"})}),"\n",(0,s.jsx)(r.h3,{id:"cicd-pivot-review",children:"CI/CD Pivot Review"}),"\n",(0,s.jsx)(r.p,{children:"Registry data often reveals deployment systems and build identities."}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"rg -n 'jenkins|gitlab|github|azure|kubernetes|helm|deploy|prod|staging' extracted-artifacts/\nrg -n 'registry|repo|nexus|artifactory|harbor' extracted-artifacts/\n"})}),"\n",(0,s.jsx)(r.h2,{id:"useful-tools",children:"Useful Tools"}),"\n",(0,s.jsxs)(r.table,{children:[(0,s.jsx)(r.thead,{children:(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.th,{children:"Tool"}),(0,s.jsx)(r.th,{children:"Purpose"})]})}),(0,s.jsxs)(r.tbody,{children:[(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"docker"})}),(0,s.jsx)(r.td,{children:"Image pull/push testing"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"curl"})}),(0,s.jsx)(r.td,{children:"Registry API checks"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"skopeo"})}),(0,s.jsx)(r.td,{children:"Remote image inspection"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"helm"})}),(0,s.jsx)(r.td,{children:"Helm repository checks"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsxs)(r.td,{children:[(0,s.jsx)(r.code,{children:"npm"})," / ",(0,s.jsx)(r.code,{children:"pip"})," / ",(0,s.jsx)(r.code,{children:"mvn"})]}),(0,s.jsx)(r.td,{children:"Package repository checks"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsxs)(r.td,{children:[(0,s.jsx)(r.code,{children:"trufflehog"})," / ",(0,s.jsx)(r.code,{children:"gitleaks"})]}),(0,s.jsx)(r.td,{children:"Secret scanning"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"syft"})}),(0,s.jsx)(r.td,{children:"SBOM and image inventory"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"httpx"})}),(0,s.jsx)(r.td,{children:"Web fingerprinting"})]})]})]}),"\n",(0,s.jsx)(r.h2,{id:"security-misconfigurations",children:"Security Misconfigurations"}),"\n",(0,s.jsxs)(r.table,{children:[(0,s.jsx)(r.thead,{children:(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.th,{children:"Misconfiguration"}),(0,s.jsx)(r.th,{children:"Risk"})]})}),(0,s.jsxs)(r.tbody,{children:[(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Anonymous read access"}),(0,s.jsx)(r.td,{children:"Private package or image disclosure"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Anonymous or broad write access"}),(0,s.jsx)(r.td,{children:"Package poisoning or image tampering"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Weak registry credentials"}),(0,s.jsx)(r.td,{children:"Supply-chain compromise"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Leaked CI tokens"}),(0,s.jsx)(r.td,{children:"Privileged registry access"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Secrets in image layers"}),(0,s.jsx)(r.td,{children:"Credential exposure"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Public build artifacts"}),(0,s.jsx)(r.td,{children:"Source and config leakage"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Overbroad robot accounts"}),(0,s.jsx)(r.td,{children:"Project-wide abuse"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:"Outdated registry software"}),(0,s.jsx)(r.td,{children:"Known vulnerability exposure"})]})]})]})]})}function p(e={}){const{wrapper:r}={...(0,i.M)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},4552:(e,r,t)=>{t.d(r,{I:()=>c,M:()=>a});var s=t(11504);const i={},n=s.createContext(i);function a(e){const r=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(n.Provider,{value:r},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.