Avatar

Labs / Registry Hijacker

  • Daily Challenge
  • Released 09 Sep 2025

🐳 Can you hijack this Docker registry and extract its hidden secrets?

A Docker registry management platform implements the Registry API v2 with enterprise security features for container image storage and distribution. But when authentication mechanisms meet implementation flaws, even the most secure registries can leak their most sensitive layers and manifests. 🎯 Time to test your container registry exploitation skills!

1
Flags
1
Points
Daily Challenge
Free Access
Start Lab Environment

Launch your dedicated AWS machine to begin hacking

~1-2 min setup
AWS dedicated
Private instance
Industry standard
Daily Challenge

🐳 Docker Registry API Manipulation & Authentication Bypass

Docker Registry API vulnerabilities allow attackers to manipulate container images, bypass authentication mechanisms, and access sensitive registry data. This challenge teaches you how to exploit Docker Registry API v2 vulnerabilities to gain unauthorized access to private repositories and extract sensitive information.

🎯 What You'll Learn
  • ✓ Docker Registry API v2 exploitation
  • ✓ Registry authentication bypass techniques
  • ✓ Image manifest manipulation
  • ✓ Blob and layer access methods
  • ✓ Container registry security assessment
🔍 Challenge Overview

You'll encounter a Docker registry management platform that implements the Docker Registry API v2. The registry contains multiple vulnerabilities including weak authentication, access control bypasses, and information disclosure that allow unauthorized access to private container images and sensitive data.

Penetration Testing Context: Docker Registry vulnerabilities are critical in containerized environments where private registries store sensitive application images, secrets, and proprietary code that can be exploited by attackers to gain access to production systems.