Artifact Registry

Default Ports: 5000, 8081, 8082, 8443

Artifact registries store container images, packages, Helm charts, build outputs, and release files. In pentests, exposed registries can leak private images, packages, source archives, CI tokens, secrets in layers, and write paths for supply-chain abuse.

Connect

Using Docker CLI

Use Docker to validate container registry read or write access.

docker login registry.target.com
docker pull registry.target.com/project/image:tag
docker image inspect registry.target.com/project/image:tag

Using curl

Registry APIs are HTTP-based and easy to fingerprint.

curl -i https://registry.target.com/v2/
curl -I https://repo.target.com/
curl -I https://harbor.target.com/

Using Package Managers

Native package managers confirm real developer and CI access paths.

npm ping --registry https://repo.target.com/repository/npm/
curl -I https://repo.target.com/repository/maven-public/
curl -I https://repo.target.com/repository/pypi/simple/
helm repo add target https://repo.target.com/chartrepo/project
helm search repo target

Using skopeo

skopeo inspects remote images without pulling into Docker.

skopeo inspect docker://registry.target.com/project/image:tag
skopeo inspect --tls-verify=false docker://registry.target.com/project/image:tag

Recon

Service Detection with Nmap

Scan common Nexus, Artifactory, Harbor, and Docker Registry ports.

nmap -p 80,443,5000,5001,8081,8082,8083,8443,9000 -sV target.com
nmap -p 80,443,5000,8081,8082,8443 --script http-title,http-headers target.com
nmap -p 443,8443 --script ssl-cert,ssl-enum-ciphers target.com

Product Fingerprinting

Product type determines API paths and permission checks.

curl -I https://repo.target.com/service/rest/v1/status
curl -I https://repo.target.com/artifactory/api/system/ping
curl -I https://harbor.target.com/api/v2.0/systeminfo
curl -I https://registry.target.com/v2/
httpx -u https://repo.target.com -title -tech-detect -status-code

Repository Path Discovery

Repository names reveal package ecosystems and deployment flows.

curl -I https://repo.target.com/repository/maven-public/
curl -I https://repo.target.com/repository/npm-private/
curl -I https://repo.target.com/repository/pypi/simple/
curl -I https://repo.target.com/repository/docker-hosted/v2/

Authentication Review

Compare anonymous, user, and CI token access.

curl -i https://registry.target.com/v2/
curl -u user:password -i https://registry.target.com/v2/
curl -H 'Authorization: Bearer TOKEN' -i https://registry.target.com/v2/

Enumeration

Docker Registry Enumeration

Docker Registry API may expose catalogs and tags.

curl -s https://registry.target.com/v2/_catalog | jq
curl -s https://registry.target.com/v2/project/image/tags/list | jq
skopeo inspect docker://registry.target.com/project/image:tag

Nexus Enumeration

Nexus REST APIs expose repositories, assets, components, and formats.

curl -u user:password https://repo.target.com/service/rest/v1/repositories | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?repository=maven-public" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/assets?repository=raw-hosted" | jq

Artifactory Enumeration

Artifactory APIs reveal repositories, builds, and artifacts.

curl -u user:password https://repo.target.com/artifactory/api/repositories | jq
curl -u user:password https://repo.target.com/artifactory/api/system/ping
curl -u user:password https://repo.target.com/artifactory/api/search/artifact?name=*.jar | jq

Harbor Enumeration

Harbor APIs expose projects, repositories, tags, and robot accounts.

curl -s https://harbor.target.com/api/v2.0/projects | jq
curl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories | jq
curl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories/REPO/artifacts | jq

Image Layer Review

mage layers can contain secrets, configs, and build leftovers.

docker pull registry.target.com/project/image:tag
docker save registry.target.com/project/image:tag -o image.tar
trufflehog filesystem image.tar
syft registry.target.com/project/image:tag

Attack Vectors

Anonymous Read Access

Anonymous reads can expose private code, packages, and images.

curl -s https://registry.target.com/v2/_catalog | jq
docker pull registry.target.com/project/private-image:latest
npm view package-name --registry https://repo.target.com/repository/npm/

Weak Credentials

Registry accounts are often reused by CI and developers.

docker login registry.target.com
curl -u user:password https://repo.target.com/service/rest/v1/repositories

Leaked Tokens

Search CI configs and source repositories for registry credentials.

rg -n 'docker login|NEXUS|ARTIFACTORY|HARBOR|REGISTRY|npm_token|_authToken' .
rg -n 'password|token|apikey|secret' .github .gitlab-ci.yml Jenkinsfile Dockerfile

Package or Image Push Abuse

Write access can allow package poisoning or image tampering.

docker tag test-image registry.target.com/project/test-image:pentest
docker push registry.target.com/project/test-image:pentest
npm publish --registry https://repo.target.com/repository/npm-hosted/

Sensitive Artifact Exposure

Artifacts may include backups, source archives, SBOMs, configs, or logs.

curl -u user:password "https://repo.target.com/service/rest/v1/search?name=backup" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?name=config" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?name=secret" | jq

Post-Exploitation

Artifact Inventory

Save repository, image, package, and tag listings as evidence.

curl -u user:password https://repo.target.com/service/rest/v1/repositories > repositories.json
curl -s https://registry.target.com/v2/_catalog > registry-catalog.json
curl -s https://registry.target.com/v2/project/image/tags/list > image-tags.json

Secret Review

Review pulled artifacts and images for credentials.

trufflehog filesystem extracted-artifacts/
gitleaks detect --source extracted-artifacts/
syft registry.target.com/project/image:tag -o table

CI/CD Pivot Review

Registry data often reveals deployment systems and build identities.

rg -n 'jenkins|gitlab|github|azure|kubernetes|helm|deploy|prod|staging' extracted-artifacts/
rg -n 'registry|repo|nexus|artifactory|harbor' extracted-artifacts/

Usefull Tools

Tool	Purpose
docker	Pull, build, push, and inspect container images
curl	Test registry APIs, endpoints, and authentication
skopeo	Inspect and copy remote container images without pulling them
helm	Audit and test Kubernetes Helm charts and repositories
npm / pip / mvn	Review and test package repositories for dependency issues
trufflehog / gitleaks	Detect exposed secrets, API keys, and credentials in repositories
syft	Generate Software Bill of Materials (SBOM) and inventory container images
httpx	Fingerprint web services, identify technologies, and probe HTTP endpoints

Security Misconfigurations

Misconfiguration	Security Risk
Anonymous read access	Unauthorized users can download private container images or packages, exposing proprietary code and sensitive data.
Anonymous or broad write access	Attackers can upload or overwrite packages/images, leading to package poisoning or malicious image tampering.
Weak registry credentials	Easily guessed or reused credentials can allow unauthorized access and compromise the software supply chain.
Leaked CI/CD tokens	Exposed pipeline tokens can provide attackers with privileged access to publish, modify, or delete artifacts.
Secrets in image layers	Hardcoded API keys, passwords, SSH keys, or tokens embedded in images can be extracted by anyone with image access.
Public build artifacts	Exposed build outputs may reveal source code, configuration files, debug information, or internal infrastructure details.
Overbroad robot/service accounts	Excessive permissions enable attackers to access or modify multiple repositories if a service account is compromised.
Outdated registry software	Unpatched registries may contain known vulnerabilities that can lead to unauthorized access, denial of service, or remote code execution.