Trivy

v0.53.0Aqua Security

Scans container images, filesystems and infrastructure-as-code for CVEs, misconfigurations and secrets. The range's Trivy reads authored image manifests and reports CVEs from the local vulnerability database.

Category: Vulnerability scanning
Package: trivy
Runs on: Linux
Commands: trivy

Reads authored image/SBOM fixtures and a local vulnerability snapshot. No registry is contacted.

Install it

The scripts below install the real Aqua Security package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-trivy.sh

Windows installer (PowerShell)

Install-trivy.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Trivy
```
sudo apt install -y trivy
```

RHEL, Fedora (dnf)

Install Trivy
```
sudo dnf install -y trivy
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Trivy
```
sudo pacman -S --noconfirm trivy
```

Alpine (apk)

Install Trivy
```
sudo apk add trivy
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which trivy
```
Check the version
```
trivy --version
```
The range reports 0.53.0.

Remove it

Take it off again
```
sudo apt remove --purge trivy
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install Trivy inside it
```
wsl sudo apt install -y trivy
```

Inside the range

Tick it on the launch screen
Under Trivy's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y trivy
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Trivy

Pentest: Cloud Privilege EscalationGiven an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.