In this lesson, we're going to discuss Grype,
a powerful vulnerability scanner,
specifically designed for container images, filesystems,
and Software Bill of Materials.
Grype is essential for pen testers
and security professionals
who need to identify and manage risk
in containerized environments.
Unlike some scanners that might focus
on a broad range of targets,
Grype is specialized and optimized for containers,
making it highly efficient in this domain.
Grype can detect vulnerabilities
in the operating system packages
and language-specific dependencies
within container images.
Grype is also used to find vulnerabilities
in Software Bills of Materials or SBOMs.
An SBOM is a detailed list of components
and dependencies in a software application,
similar to a recipe that outlines all ingredients.
Two popular file types for SBOMs
are Software Package Data Exchange or SPDX,
CycloneDX or CDX.
This is crucial for understanding
the makeup of your software,
especially in complex environments
with numerous dependencies.
This process assures that any known vulnerabilities
in the components of your software
are identified and can be addressed.
So, here's a sample of an SBOM file,
just so you can see.
The command structure for Grype is pretty straightforward.
For example, if you have an SBOM file in JSON format
named sbom.cdx.json,
you can run the grype sbom:sbom.cdx.json command.
Alternatively, you can just type the path to the file
and type grype sbom.cdx.json.
Using that command, we will receive the following output.
We see here that Grype has identified three vulnerabilities
for us to potentially investigate further.
We could also use Grype to scan container images.
You simply use the word Grype
followed about the image reference.
For example, to scan a Docker image named vulnerable-image,
you would run the following command,
sudo grype docker:vulnerable-image.
Here, I use the sudo,
since I needed to elevate my privileges
just to use the scanner against the docker images.
This command will produce an output
that lists all identified vulnerabilities
categorized by their severity.
Here's what that output will look like
when we scan the image.
And lastly, let me quickly show you an example
of how to scan a file system or directory
for vulnerable software.
Keeping the same format as earlier,
we would run the following command,
sudo grype dir, for directory,
:tmp/sample_files,
and receive the following output.
Again, we see here
that the files contained in my directory tmp/sample_ files
contain vulnerable software files.
During the pen test,
we would document these findings for further exploration.
So, remember, Grype is a specialized tool
designed for identifying vulnerabilities
and container images, file systems,
and Software Bill of Materials.
It pulls data from various sources
to provide comprehensive vulnerability detection,
making it an invaluable tool
for security assessments and containerized environments.
Using Grype can significantly enhance your ability
to perform thorough vulnerability assessments
during a pen test.