Skip to content
HackIndex logo

HackIndex

ECR Container Registry Enumeration

2 min read May 24, 2026

Container images frequently contain hardcoded secrets, internal service URLs, and build-time credentials. Pulling and inspecting images requires only ecr:GetAuthorizationToken and ecr:BatchGetImage.

List Repositories

┌──(kali㉿kali)-[~]
└─$ aws ecr describe-repositories --profile $PROFILE --region $REGION --query 'repositories[*].{Name:repositoryName,URI:repositoryUri,Created:createdAt}' --output table

List Images in a Repository

┌──(kali㉿kali)-[~]
└─$ aws ecr list-images --repository-name $REPO_NAME --profile $PROFILE --region $REGION --query 'imageIds[*].{Tag:imageTag,Digest:imageDigest}' --output table
┌──(kali㉿kali)-[~]
└─$ aws ecr describe-images --repository-name $REPO_NAME --profile $PROFILE --region $REGION --query 'imageDetails[*].{Digest:imageDigest,Tags:imageTags,Size:imageSizeInBytes,Pushed:imagePushedAt}' --output table

Authenticate Docker to ECR

┌──(kali㉿kali)-[~]
└─$ aws ecr get-login-password --profile $PROFILE --region $REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com

Pull and Inspect an Image

┌──(kali㉿kali)-[~]
└─$ docker pull $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
┌──(kali㉿kali)-[~]
└─$ docker inspect $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
┌──(kali㉿kali)-[~]
└─$ docker inspect $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG | jq '.[0].Config.Env'

Extract Secrets from Image Layers

Image history shows build commands including any credentials passed as ARG or RUN steps:

┌──(kali㉿kali)-[~]
└─$ docker history --no-trunc $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG
┌──(kali㉿kali)-[~]
└─$ docker save $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$REPO_NAME:$TAG -o image.tar
┌──(kali㉿kali)-[~]
└─$ mkdir image_layers && tar xf image.tar -C image_layers/
┌──(kali㉿kali)-[~]
└─$ find image_layers/ -name "*.tar" -exec tar xf {} -C image_layers/ \;
┌──(kali㉿kali)-[~]
└─$ grep -r "key\|secret\|password\|token\|credential\|aws_" image_layers/ -i --include="*.env" --include="*.conf" --include="*.json" --include="*.yml" 2>/dev/null

Repository Policy

Check if the repository allows cross-account or public access:

┌──(kali㉿kali)-[~]
└─$ aws ecr get-repository-policy --repository-name $REPO_NAME --profile $PROFILE --region $REGION | jq '.policyText | fromjson'

"Principal": "*" in the policy means anyone can pull from the repository.

Public repositories on ECR Public Gallery (public.ecr.aws) require no authentication:

┌──(kali㉿kali)-[~]
└─$ aws ecr-public describe-repositories --profile $PROFILE --region us-east-1