Performing Container Security Scanning With Trivy

TL;DR

• 目的：Scan container images, filesystems, Git repositories, and Kubernetes manifests for OS and language-dependency vulnerabilities, IaC misconfig…
• 适用：云/K8s/容器/配置审计
• 输入：镜像名（docker save 或 registry）+ 扫描输出格式
• 输出：配置审计报告 + 修复建议
• 红线：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
• 关联：上游：003-src-session-start → 下游：043-hunt-nosqli, 027-hunt-cors, 028-hunt-csrf

Performing Container Security Scanning with Trivy

Quick Start

# 扫描镜像
trivy image nginx:latest
# 扫描文件系统
trivy fs --security-checks vuln,config /path/to/project

Overview

Trivy is an open-source security scanner by Aqua Security that detects vulnerabilities in OS packages and language-specific dependencies, infrastructure-as-code misconfigurations, exposed secrets, and software license issues across container images, filesystems, Git repositories, and Kubernetes clusters. Trivy generates Software Bill of Materials (SBOM) in CycloneDX and SPDX formats for supply chain transparency. This skill covers comprehensive container image scanning, CI/CD pipeline integration, Kubernetes operator deployment, and scan result triage for security operations.

When to Use

• When conducting security assessments that involve performing container security scanning with trivy
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Trivy v0.50+ installed (binary, Docker, or Homebrew)
• Docker daemon access for local image scanning
• Container registry credentials for remote image scanning
• CI/CD platform (GitHub Actions, GitLab CI, Jenkins) for pipeline integration
• Kubernetes cluster for Trivy Operator deployment (optional)

Workflow

Step 1: Scan Container Images

Run vulnerability and secret scanning against container images from local builds or remote registries. Configure severity thresholds and ignore unfixed vulnerabilities.

Step 2: Generate SBOM

Produce CycloneDX or SPDX SBOM documents from scanned images for supply chain compliance and vulnerability tracking across the software lifecycle.

Step 3: Scan IaC and Kubernetes Manifests

Detect misconfigurations in Dockerfiles, Kubernetes YAML, Terraform, and Helm charts using built-in policy checks aligned with CIS benchmarks.

Step 4: Integrate into CI/CD

Add Trivy scanning as a pipeline gate that blocks builds with critical/high vulnerabilities, generates SARIF reports for GitHub Advanced Security, and produces JUnit XML for test dashboards.

Output Format

JSON/table report listing CVEs with severity, CVSS scores, fixed versions, affected packages, misconfiguration findings, and exposed secrets with file locations.

Validation Criteria

A successful discovery of this vulnerability class must demonstrate:

• POC reproducible against fresh target instance (timestamp documented)
• Impact scope quantified (data leaked / privilege gained / RCE achieved)
• CVSS or business risk score assigned
• Authorization scope documented (B SRC vs target, A 项目 vs 全量)
• No destructive side effects (if RCE, sandboxed proof preferred)
• Affected endpoint clearly identified with full URL/request

If any of these cannot be demonstrated, treat the finding as inconclusive and run 111-fp-check for cross-verification.

Workflow

1. Recon — Identify the target endpoint via 96-osint-methodology or 009-osint-with-spiderfoot
2. Fingerprint — Confirm component/version using 01-component-nday or Burp Suite passive detection
3. Probe — Send payload variations matching the vulnerability class
4. Verify — Run 111-fp-check to confirm with second tool
5. Document — Fill report template (project-pentest / cnvd-common / edusrc / butian)
6. Submit — Manual submission (never auto-submit)

Tools & Systems

• Burp Suite Pro / Community — Intercepting proxy, scanner, and Repeater for manual testing
• OWASP ZAP — Open-source alternative to Burp with active scanner
• sqlmap — Automated SQL injection detection (for hunt-sqli)
• Nuclei — Template-based vulnerability scanner
• ffuf — Fast web fuzzer for endpoint discovery
• curl / wget — Manual HTTP request crafting
• httpx — HTTP probing and fingerprinting

Run all tools with -rate-limit 20 to avoid OPSEC issues. For deeper investigation, prefer manual testing with Burp over automated scanners (lower false-positive rate).

Advanced Techniques

Chained Vulnerability Exploitation

Combine multiple low-severity findings (open redirect + cookie theft + session hijacking) to demonstrate high-impact chains in reporting.

WAF Evasion Patterns

Use case variations, encoding (URL, double-URL, Unicode), chunked transfer, and parameter pollution to bypass WAF/IDS during testing.