Pentester Academy – Container Security Bootcamp

A hands-on introduction to Container Security, this bootcamp shows you how misconfigured components can lead to breakout attacks and eventually, host compromise.

You will learn to use different tools and techniques to audit containers, container hosts, image repositories and container management tools. Our unique lab setup lets you try low-level breakout attacks which otherwise can only be done in local virtual machines.

9+ Hours of Live Session Recordings
Over 60 Lab Exercises
Subscribe to access bootcamp recordings and more!

Bootcamp recordings for select topics, accessible anytime
Follow along with instructors as they walk you through both theory and practice! With bootcamp recordings at your fingertips, master in-demand topics at your own pace, without time zone concerns. Take your time to go through our massive content library – you’ll need it!

Prerequisites
1. A basic knowledge of computers and networking
2. Familiarity with the Linux operating system

Who should join this bootcamp?
1. Beginners and enthusiasts interested in building a foundation in Container Security
2. Red Teamers and Pentesters who need to add Container Security to their professional skillset
3. Security professionals dealing with Docker environments
Bootcamp Syllabus

Module I: Protocol Basics, Traffic Sniffing, and Recon
Before learning about attack techniques, we first need to establish a good understanding of Linux containers. The first session is therefore foundational, where we will go through Linux container basics and how to use Docker to create, manage and run containers. You will also get an introduction to the Open Container Initiative (OCI) and the various elements of a container system.
Container Basics
Basic container principles
How containers differ from virtual machines (VMs)
Namespaces
cgroups
Introduction to Docker
Basic commands and concepts
Components i.e. client, daemon, image, container, registry, volume, network
Using Docker
Pulling an image
Running a container
Building a container
Pushing a container
Dockerfile
Multi-container deployment
Manual setup
docker-compose
Introduction to low-level components
containerd
runc
Module II: Attacking Personal Networks

In our second session, we will start learning about Docker attacks. Here, you will learn to leverage privileged containers, excessive capabilities, shared namespaces, mounted sockets to perform container breakouts. Not only will you learn these attacks in theory, you’ll also get a chance to practice them hands-on in our labs.

Docker security
Threat modeling
Understanding risk vectors
Docker container breakouts
Privileged containers
Mounted volumes
Shared namespaces
Additional Linux capabilities
Process injection (SYS_PTRACE)
Abusing SYS_MODULE capability
Module III: Docker Host Security and Docker Forensics
Our third session focuses on Docker host attacks. We will learn to exploit misconfigured sockets, inadequately protected management tools, overly permissible settings, low-level runtime to perform attacks on the Docker host.

Then, we will cover Docker image security, the risks of running an insecure Docker registry along with the threat of backdoored images. This session will be heavily hands-on, and you will use tools and techniques to perform attacks and analysis on different components of Docker.

Attacking a Docker host
Mounted Docker socket
World writable socket
Exposed Docker socket
Management tools as attack vectors
Portainer
WatchGuard
Docker image-based attacks
Insecure Docker Registry
Evil image
Corrupting source image
Docker forensics
Analyzing images and exported tar archives
Container forensics
Checkpoints
Module IV: Securing Docker Infrastructure

Our final session focuses on defense. Here, you will learn the tools and best practices to secure a Docker environment, such as how to use AppArmor and seccomp to restrict possible operations for containers and scanning Docker images for vulnerabilities with clair.

The bootcamp will conclude with discussions on DCT and enabling TLS/authentication on a private Docker registry. By the end of this session, you’d have amassed both theoretical knowledge and practical experience with container-based attacks and defenses, and thus be prepared to take the certification exam.
Securing Docker
Auditing socket permissions and Docker group
User namespace remapping
Auditing runtime
Monitoring containers
Docker events and logs
Third-party tools
Securing Docker images
Dockerfile linting and audit
Best practices
Third-party tools/scanners
Securing a private registry
Deploying authentication
SSL support
MEET THE INSTRUCTOR

Nishant Sharma
Nishant Sharma leads R&D at Pentester Academy and Attack Defense. He has 8+ years of experience in the information security field including 6+ years in WiFi security research and development. He has conducted classroom trainings in Blackhat USA, HITB Amsterdam/Singapore, RootCon, OWASP NZ Day. He has presented research and conducted workshops at Blackhat USA/Asia, DEF CON China, HITB, RootCon, Packet Hacking Village, Wireless Village, IoT village and Demo labs (DEFCON USA). Prior to joining Pentester Academy, he worked as a firmware developer at Mojo Networks where he contributed in developing new features for the enterprise-grade WiFi APs and maintaining the state of art WiFi Intrusion Prevention System (WIPS). He has a Master’s degree in Information Security from IIIT Delhi. He has also published peer-reviewed academic research on HMAC security. His areas of interest include WiFi and IoT security, Linux security.