Artifact Registry

Default Ports: 5000, 8081, 8082, 8443

Artifact registries store container images, packages, Helm charts, build outputs, and release files. In pentests, exposed registries can leak private images, packages, source archives, CI tokens, secrets in layers, and write paths for supply-chain abuse.

Connect

Using Docker CLI

Use Docker to validate container registry read or write access.

docker login registry.target.com
docker pull registry.target.com/project/image:tag
docker image inspect registry.target.com/project/image:tag

Using curl

Registry APIs are HTTP-based and easy to fingerprint.

curl -i https://registry.target.com/v2/
curl -I https://repo.target.com/
curl -I https://harbor.target.com/

Using Package Managers

Native package managers confirm real developer and CI access paths.

npm ping --registry https://repo.target.com/repository/npm/
curl -I https://repo.target.com/repository/maven-public/
curl -I https://repo.target.com/repository/pypi/simple/
helm repo add target https://repo.target.com/chartrepo/project
helm search repo target

Using skopeo

skopeo inspects remote images without pulling into Docker.

skopeo inspect docker://registry.target.com/project/image:tag
skopeo inspect --tls-verify=false docker://registry.target.com/project/image:tag

Recon

Service Detection with Nmap

Scan common Nexus, Artifactory, Harbor, and Docker Registry ports.

nmap -p 80,443,5000,5001,8081,8082,8083,8443,9000 -sV target.com
nmap -p 80,443,5000,8081,8082,8443 --script http-title,http-headers target.com
nmap -p 443,8443 --script ssl-cert,ssl-enum-ciphers target.com

Product Fingerprinting

Product type determines API paths and permission checks.

curl -I https://repo.target.com/service/rest/v1/status
curl -I https://repo.target.com/artifactory/api/system/ping
curl -I https://harbor.target.com/api/v2.0/systeminfo
curl -I https://registry.target.com/v2/
httpx -u https://repo.target.com -title -tech-detect -status-code

Repository Path Discovery

Repository names reveal package ecosystems and deployment flows.

curl -I https://repo.target.com/repository/maven-public/
curl -I https://repo.target.com/repository/npm-private/
curl -I https://repo.target.com/repository/pypi/simple/
curl -I https://repo.target.com/repository/docker-hosted/v2/

Authentication Review

Compare anonymous, user, and CI token access.

curl -i https://registry.target.com/v2/
curl -u user:password -i https://registry.target.com/v2/
curl -H 'Authorization: Bearer TOKEN' -i https://registry.target.com/v2/

Enumeration

Docker Registry Enumeration

Docker Registry API may expose catalogs and tags.

curl -s https://registry.target.com/v2/_catalog | jq
curl -s https://registry.target.com/v2/project/image/tags/list | jq
skopeo inspect docker://registry.target.com/project/image:tag

Nexus Enumeration

Nexus REST APIs expose repositories, assets, components, and formats.

curl -u user:password https://repo.target.com/service/rest/v1/repositories | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?repository=maven-public" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/assets?repository=raw-hosted" | jq

Artifactory Enumeration

Artifactory APIs reveal repositories, builds, and artifacts.

curl -u user:password https://repo.target.com/artifactory/api/repositories | jq
curl -u user:password https://repo.target.com/artifactory/api/system/ping
curl -u user:password https://repo.target.com/artifactory/api/search/artifact?name=*.jar | jq

Harbor Enumeration

Harbor APIs expose projects, repositories, tags, and robot accounts.

curl -s https://harbor.target.com/api/v2.0/projects | jq
curl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories | jq
curl -s https://harbor.target.com/api/v2.0/projects/PROJECT/repositories/REPO/artifacts | jq

Image Layer Review

Image layers can contain secrets, configs, and build leftovers.

docker pull registry.target.com/project/image:tag
docker save registry.target.com/project/image:tag -o image.tar
trufflehog filesystem image.tar
syft registry.target.com/project/image:tag

Attack Vectors

Anonymous Read Access

Anonymous reads can expose private code, packages, and images.

curl -s https://registry.target.com/v2/_catalog | jq
docker pull registry.target.com/project/private-image:latest
npm view package-name --registry https://repo.target.com/repository/npm/

Weak Credentials

Registry accounts are often reused by CI and developers.

docker login registry.target.com
curl -u user:password https://repo.target.com/service/rest/v1/repositories

Leaked Tokens

Search CI configs and source repositories for registry credentials.

rg -n 'docker login|NEXUS|ARTIFACTORY|HARBOR|REGISTRY|npm_token|_authToken' .
rg -n 'password|token|apikey|secret' .github .gitlab-ci.yml Jenkinsfile Dockerfile

Package or Image Push Abuse

Write access can allow package poisoning or image tampering.

docker tag test-image registry.target.com/project/test-image:pentest
docker push registry.target.com/project/test-image:pentest
npm publish --registry https://repo.target.com/repository/npm-hosted/

Sensitive Artifact Exposure

Artifacts may include backups, source archives, SBOMs, configs, or logs.

curl -u user:password "https://repo.target.com/service/rest/v1/search?name=backup" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?name=config" | jq
curl -u user:password "https://repo.target.com/service/rest/v1/search?name=secret" | jq

Post-Exploitation

Artifact Inventory

Save repository, image, package, and tag listings as evidence.

curl -u user:password https://repo.target.com/service/rest/v1/repositories > repositories.json
curl -s https://registry.target.com/v2/_catalog > registry-catalog.json
curl -s https://registry.target.com/v2/project/image/tags/list > image-tags.json

Secret Review

Review pulled artifacts and images for credentials.

trufflehog filesystem extracted-artifacts/
gitleaks detect --source extracted-artifacts/
syft registry.target.com/project/image:tag -o table

CI/CD Pivot Review

Registry data often reveals deployment systems and build identities.

rg -n 'jenkins|gitlab|github|azure|kubernetes|helm|deploy|prod|staging' extracted-artifacts/
rg -n 'registry|repo|nexus|artifactory|harbor' extracted-artifacts/

Useful Tools

Tool	Purpose
docker	Image pull/push testing
curl	Registry API checks
skopeo	Remote image inspection
helm	Helm repository checks
npm / pip / mvn	Package repository checks
trufflehog / gitleaks	Secret scanning
syft	SBOM and image inventory
httpx	Web fingerprinting

Security Misconfigurations

Misconfiguration	Risk
Anonymous read access	Private package or image disclosure
Anonymous or broad write access	Package poisoning or image tampering
Weak registry credentials	Supply-chain compromise
Leaked CI tokens	Privileged registry access
Secrets in image layers	Credential exposure
Public build artifacts	Source and config leakage
Overbroad robot accounts	Project-wide abuse
Outdated registry software	Known vulnerability exposure