Docker Container Vulnerability Assessment

📌 Project Overview

This project demonstrates a comprehensive vulnerability assessment of a Dockerized Damn Vulnerable Web Application (DVWA) using Kali Linux and Trivy scanner.

📂 Structure

• Docker/: Docker Compose configuration.
• Remediation/: Hardening recommendations.
• Report/: Final vulnerability assessment report.
• Scans/: Screenshots of Trivy scan and CVE findings.
• Scripts/: PowerShell automation scripts.
• dvwa_scan_report.txt: Raw Trivy output.

🛡️ Tools Used

• Trivy (by Aqua Security)
• Docker 26.1.5
• Kali Linux 2025.2

📈 Key Findings

• 1,575 vulnerabilities (256 Critical)
• End-of-life base image (Debian 9.5)
• Multiple Apache CVEs (e.g., CVE-2021-40438)

📜 Standards Referenced

• OWASP Docker Top 10
• NIST SP 800-190
• ISO/IEC 27001:2013 A.12.6.1
• CIS Docker Benchmark

🔒 Recommendations

• Use minimal secure base images
• Apply regular CVE patching
• Employ secrets management

---

🔗 References

• Trivy
• Docker Hub: DVWA
• OWASP Docker Top 10