DevSecOps › Module 7 › Lesson 2
Trivy Named
Trivy literacy — scan command stub, vulnerability table, misconfig scan, secret scan flag, report format — named Trivy rows on YOUR `$DEVSEC_LAB` images.
Visual · t36_trivy_named
Trivy = named scan tool literacy. $DEVSEC_LAB. Original Cyberlium.
Opening
Trivy scans YOUR images and IaC — name command and report rows on YOUR lab artifacts, never weaponize Trivy output against stranger pipelines.
Trivy named literacy names: image scan command stub category, vulnerability table column category (CVE, severity, fixed version literacy), misconfiguration scan mode category, secret scan flag category, and report format category (JSON, SARIF literacy stub). Analyst documents Trivy scan card on `$DEVSEC_LAB` lab image from 7-1 — command stub, three vulnerability rows, report format — without running Trivy against stranger org images, without publishing scan dumps to shame third parties, without pipeline sabotage using scan output. Cyberlium teaches Trivy vocabulary on YOUR notes — shift-left container literacy. Refused: stranger org scans, forged CVE reports, sabotage recipes. Lab row: Trivy scan card (command stub, three vuln rows, report format).
1. Named Trivy rows
Scan command, vuln table columns, misconfig mode, secret flag, report format — five literacy anchors.
Each vuln row cites YOUR lab image output — not copied stranger reports.
Command guide
Try these commands — Named Trivy rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ZAP — https://www.zaproxy.org/ ZAP baseline scan — https://www.zaproxy.org/docs/docker/baseline-scan/ NIST SSDF RV.1 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_DAST=${DEVSEC_DAST:-$DEVSEC_LAB/dast}
cat > "$DEVSEC_DAST/baseline-plan.md" <<'EOF'
# ZAP Baseline Plan — YOUR localhost only
## Prerequisites
1. Run YOUR lab app on 127.0.0.1:8080 (container/app.sh or python -m http.server)
2. Confirm scope: localhost ONLY — never stranger URLs
## Steps
1. curl -sS http://127.0.0.1:8080/ | head -5 # verify app responds
2. Optional docker ZAP:
docker run --rm --network host owasp/zap2docker-stable \
zap-baseline.py -t http://127.0.0.1:8080 -r zap-report.html
3. Document alerts in findings/ — informational for lab app
## Refusals
- NEVER: zap against stranger sites or unauthorized production apps
EOFCommand — copy this
grep -E '127.0.0.1|NEVER|localhost|zap-baseline' "$DEVSEC_DAST/baseline-plan.md"
python3 -c "print('DAST plan: baseline against YOUR 127.0.0.1:8080 only — optional docker ZAP')"Primary tools to practice this lesson: grep, python3. Reference sites: OWASP ZAP (https://www.zaproxy.org/); ZAP baseline scan (https://www.zaproxy.org/docs/docker/baseline-scan/); NIST SSDF RV.1 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Multi-target literacy
Trivy scans images, filesystems, and IaC — link Module 6 Checkov as complementary stub.
Secret scan flag documented — not optional on lab CI gate literacy.
3. Refused
No Trivy against stranger org images; no forged reports; no pipeline sabotage.
Trivy literacy supports YOUR container hygiene — not offensive registry abuse.
4. What you ship: Trivy scan card
Command stub + three vuln rows + report format + NEVER stranger org scan line.
5. What you record before the next lesson
Trivy scan card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Trivy against stranger org Docker Hub images and publish CVE dump publicly as 'awareness.'
Right
Trivy scan card from `$DEVSEC_LAB` lab image. Next: Base Image Hygiene.
Mission: Trivy scan card
1) Name five Trivy literacy rows. 2) Scan command stub for lab image. 3) Three vulnerability rows with severity. 4) Write NEVER stranger org scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SARIF vs JSON — literacy handoff stub?”
Knowledge Check
APPLY: Trivy literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Publishing stranger org Trivy dumps is course lab.
True or False
Knowledge Check
APPLY: Trivy scan card includes:
Multiple choice