docker-find

Let's automate some docker forensics! Search for specific terms in a docker image.

Inspired by docker-based challenges on CTFs

Examples

• Whale Watching

$ ./docker-find.sh johnhammond/whale_watching flag{

• Peel back the layers

$ ./docker-find.sh steammaintainer/gearrepairimage HTB{

Usage

$ ./docker-find [image] [search-term]

Search Steps

1. search docker history
2. search docker inspect
3. search layers
   1. run grep on layer files
   2. run strings on layer files

References

• docker-forensics