Docker Forensics
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
There are suspicions that some docker container was compromised:
You can easily find the modifications done to this container with regards to the image with:
In the previous command C means Changed and A, Added.
If you find that some interesting file like /etc/shadow
was modified you can download it from the container to check for malicious activity with:
You can also compare it with the original one running a new container and extracting the file from it:
If you find that some suspicious file was added you can access the container and check it:
Then, you can decompress the image and access the blobs to search for suspicious files you may have found in the changes history:
You can get basic information from the image running:
You can also get a summary history of changes with:
You can also generate a dockerfile from an image with:
This allows you to navigate through the different blobs of docker images and check which files were modified/added. Red means added and yellow means modified. Use tab to move to the other view and space to collapse/open folders.
With die you won't be able to access the content of the different stages of the image. To do so you will need to decompress each layer and access it. You can decompress all the layers from an image from the directory where the image was decompressed executing:
Note that when you run a docker container inside a host you can see the processes running on the container from the host just running ps -ef
When you are given an exported docker image (probably in .tar
format) you can use to extract a summary of the modifications:
In order to find added/modified files in docker images you can also use the (download it from ) utility:
Therefore (as root) you can dump the memory of the processes from the host and search for credentials just .
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.