Docker - Port 2375,2376
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Docker is a widely used containerization platform that allows developers to package applications with their dependencies into isolated units. However, misconfigurations, exposed APIs, and poor access control practices can create serious security risks. This guide provides comprehensive techniques for Docker penetration testing, focusing on real-world attack vectors, privilege escalation, container escape, and host exploitation.
Docker’s remote API may be exposed on:
Port 2375 (unencrypted)
Port 2376 (TLS-encrypted)
Scan using Nmap:
Check for Docker API access:
If you receive JSON output, the Docker API is unauthenticated and exposed.
Then start it:
Access with:
This allows you to escape to the host by accessing /host.
/var/run/docker.sock)When Docker is exposed via the Docker socket, it allows root-level control over the host.
Check access:
If you have write access to docker.sock, you can create a container with the host mounted:
This drops you into the host filesystem as root.
Check if container runs with --privileged:
If you see docker with no restrictions, and cap_sys_admin, then:
Containers running with -v /:/mnt allow direct access to the host’s root filesystem.
Escalate:
Then modify /etc/shadow, /etc/sudoers, or inject SSH keys.
Check for containerized environment:
Look for environment variables like:
Presence of /docker-entrypoint.sh, /var/run/docker.sock, or .dockerenv are telltale signs.
Access registry:
List tags:
Pull vulnerable images:
Analyze locally for secrets or backdoors.
If a user is in the docker group, they can effectively become root:
Check:
If docker is listed, the user has full control over the host.
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚