f

Author: carlospolop

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md

@@ -95,11 +95,6 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 ```
 
 
-
-
-
-
-
 ### Exfiltrate upstream registry credentials from ECR Pull‑Through Cache (PTC)
 
 If ECR Pull‑Through Cache is configured for authenticated upstream registries (Docker Hub, GHCR, ACR, etc.), the upstream credentials are stored in AWS Secrets Manager with a predictable name prefix: `ecr-pullthroughcache/`. Operators sometimes grant ECR admins broad Secrets Manager read access, enabling credential exfiltration and reuse outside AWS.
@@ -218,4 +213,39 @@ aws ecr put-registry-scanning-configuration --region $REGION --scan-type BASIC -
 aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value AWS_NATIVE
 ```
 
+
+### Scan ECR images for vulenrabilities
+
+```bash
+#!/bin/bash
+
+# This script pulls all images from ECR and runs snyk on them showing vulnerabilities for all images
+
+region=<region>
+profile=<aws_profile>
+
+registryId=$(aws ecr describe-registry --region $region --profile $profile --output json | jq -r '.registryId')
+
+# Configure docker creds
+aws ecr get-login-password --region $region --profile $profile | docker login --username AWS --password-stdin $registryId.dkr.ecr.$region.amazonaws.com
+
+while read -r repo; do
+    echo "Working on repository $repo"
+    digest=$(aws ecr describe-images --repository-name $repo --image-ids imageTag=latest --region $region --profile $profile --output json | jq -r '.imageDetails[] | .imageDigest')
+    if [ -z "$digest" ]
+    then 
+      echo "No images! Empty repository"
+      continue
+    fi
+    url=$registryId.dkr.ecr.$region.amazonaws.com/$repo@$digest
+    echo "Pulling $url"
+    docker pull $url
+    echo "Scanning $url"
+    snyk container test $url --json-file-output=./snyk/$repo.json --severity-threshold=high
+    # trivy image -f json -o ./trivy/$repo.json --severity HIGH,CRITICAL $url
+    # echo "Removing image $url"
+    # docker image rm $url
+done < <(aws ecr describe-repositories --region $region --profile $profile --output json | jq -r '.repositories[] | .repositoryName')
+```
+
 {{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md

@@ -179,6 +179,83 @@ helm template chart /path/to/chart \
 ```
 
 
+## Scan dependency issues
+
+### Scan images
+
+```bash
+#!/bin/bash
+export images=$(kubectl get pods --all-namespaces -o jsonpath="{range .items[]}{.spec.containers[].image}{'\n'}{end}" | sort | uniq)
+echo "All images found: $images"
+echo ""
+echo ""
+for image in $images; do
+    # Run trivy scan and save JSON output
+    trivy image --format json --output /tmp/result.json --severity HIGH,CRITICAL "$image" >/dev/null 2>&1
+    # Extract binary targets that have vulnerabilities
+    binaries=$(jq -r '.Results[] | select(.Vulnerabilities != null) | .Target' /tmp/result.json)
+    if [ -n "$binaries" ]; then
+        echo "- **Image:** $image"
+        while IFS= read -r binary; do
+            echo "  - **Binary:** $binary"
+            jq -r --arg target "$binary" '
+                .Results[] | select(.Target == $target) | .Vulnerabilities[] | 
+                "    - **\(.Title)** (\(.Severity)): Affecting `\(.PkgName)` fixed in version `\(.FixedVersion)` (current version is `\(.InstalledVersion)`)."
+            ' /tmp/result.json
+        done <<< "$binaries"
+        echo ""
+        echo ""
+        echo ""
+    fi
+done
+```
+
+### Scan Helm charts
+
+```bash
+#!/bin/bash
+# scan-helm-charts.sh
+# This script lists all Helm releases, renders their manifests,
+# and then scans each manifest with Trivy for configuration issues.
+
+# Check that jq is installed
+if ! command -v jq &>/dev/null; then
+  echo "jq is required but not installed. Please install jq and rerun."
+  exit 1
+fi
+
+# List all helm releases and extract namespace and release name
+echo "Listing Helm releases..."
+helm list --all-namespaces -o json | jq -r '.[] | "\(.namespace) \(.name)"' > helm_releases.txt
+
+# Check if any releases were found
+if [ ! -s helm_releases.txt ]; then
+  echo "No Helm releases found."
+  exit 0
+fi
+
+# Loop through each Helm release and scan its rendered manifest
+while IFS=" " read -r namespace release; do
+  echo "---------------------------------------------"
+  echo "Scanning Helm release '$release' in namespace '$namespace'..."
+  # Render the Helm chart manifest
+  manifest_file="${release}-manifest.yaml"
+  helm get manifest "$release" -n "$namespace" > "$manifest_file"
+  if [ $? -ne 0 ]; then
+    echo "Failed to get manifest for $release in $namespace. Skipping."
+    continue
+  fi
+  # Scan the manifest with Trivy (configuration scan)
+  echo "Running Trivy config scan on $manifest_file..."
+  trivy config --severity MEDIUM,HIGH,CRITICAL "$manifest_file"
+  echo "Completed scan for $release."
+done < helm_releases.txt
+
+echo "---------------------------------------------"
+echo "Helm chart scanning complete."
+```
+
+
 
 ## Tips