Docker

1
# Displays a list of images available on your system.
2
sudo docker images

1
# List running Docker containers
2
sudo docker ps

1
# Starts (or creates if not existing) the containers defined in the docker-compose.yml file
2
sudo docker-compose up -d

1
# Stop all containers
2
sudo docker-compose down

1
# Delete Docker image (from docker ps output)
2
sudo docker rmi 6037dc305bb2

1
# Enter a Docker container (get NAMES from docker ps output)
2
sudo docker exec -it image_name sh

1
# Maps a host directory to the container to save scan results and logs permanently
2
sudo docker run --rm -v $(pwd)/loot:/root/loot image_name

1
# Runs the container on the host network stack for better scanning and sniffing (e.g., Nmap/Responder)
2
sudo docker run --rm --net=host -it image_name

1
# Forwards a specific port to catch reverse shells or host malicious web servers
2
sudo docker run --rm -p 4444:4444 -it image_name

1
# Injects sensitive credentials or API keys (like Shodan/Censys) without saving them in the image
2
sudo docker run --rm -e API_KEY=your_key_here image_name

1
# Forces the container to use a specific shell or tool regardless of its default entrypoint
2
sudo docker run --rm -it --entrypoint /bin/bash image_name

1
# Completely wipes all engagement artifacts, including volumes and unused images
2
sudo docker system prune -a --volumes