In this lesson, we're going to discuss Trivy.
Trivy is a comprehensive and versatile security scanner.
Now, Trivy is used to discover vulnerabilities,
misconfigurations, secrets, and more.
It is used for scanning containers, Kubernetes,
file systems, Git repositories,
virtual machine images, Kubernetes clusters,
and AWS environments, so it can do a lot.
Trivy is designed to help pen testers
and security professionals
identify and manage risk in various environments.
It can also detect OS package vulnerabilities,
software dependency issues, IaC misconfigurations,
sensitive information, and software licenses.
It's particularly known for its simplicity
and its comprehensive detection capabilities,
making it a favorite tool
amongst a lot of security professionals.
Now, Trivy works by pulling vulnerability data
from multiple sources,
including the vulnerability databases
like the National Vulnerability Database, or NVD,
and various distribution security advisories.
It then compares this data
against the components in your target environment
to identify potential security risk.
The primary types of scans that are common with Trivy
are file systems, images, and repository scans.
The command breakdown for Trivy is pretty straightforward,
which is just the word Trivy and file path or URL.
For example, trivy fs, with the file path, home/parallels
will produce the following result.
So the vulnerability highlighted by Trivy
in its output is an exposed asymmetric private key
within an open VPN configuration file,
JamarioK (1).ovpn.
Private keys are meant to be kept confidential.
Their presence in a file accessible to others
poses a significant security risk.
Anyone with access to this file
could impersonate the legitimate owner of the key,
potentially gaining unauthorized access to systems or data.
So if we were to conduct the pen test,
we'll potentially exploit this vulnerability.
Next, we're scanning an image.
We will use the command with a similar structure.
I've created an intentionally vulnerable docker image
for the scan.
So note, if you're following along,
you might need to use the pseudo command
to execute with higher level privileges.
The command here is trivy image vulnerable-image.
This output shows multiple vulnerabilities
associated with this image and their respective CVEs
with their severity levels.
Finally, let me show you an example
of how to scan a code repository in GitHub using Trivy.
The command Trivy repo,
and then you put the URL, so we're going to use GitHub,
will produce the following output.
We see here that there are multiple vulnerabilities
that we can catalog and research for use
once we get to the attack phase of our pen test.
For example, let's say during the pen test
on the web application,
using vulnerability pymdown-extensions,
library version 9.5,
you identify a high severity file inclusion vulnerability,
which is CVE-2023-32309.
By crafting a malicious markdown file
that includes a snippet pointing to the Etsy/password file,
you can upload it
through the applications file upload functionality.
When the application processes this file,
the PYM down snippets extensions
includes and displays the contents of assisted file,
allowing you to gain access to critical system information.
This exploit demonstrates the risk posed
by outdated dependencies
and emphasizes the need for regular updates
and proper file validation
to protect against such vulnerabilities.
You don't need to know all the details
of the particular vulnerability.
You just need to know how to research it
and apply to exploit
by using search functions in something like Meta Exploit.
So remember, Trivy is a powerful tool
for identifying vulnerabilities in container images,
file systems, and repositories.
Using Trivy can significantly enhance your ability
to perform thorough vulnerability assessments
during your pen test.