Trivy offline vulnerability scanning

Trivy Offline Vulnerability Scanning

This skill provides guidance on using Trivy, an open-source security scanner, to discover vulnerabilities in software dependencies using offline mode.

Overview

Trivy is a comprehensive vulnerability scanner that can analyze various targets including container images, filesystems, and dependency lock files. Offline scanning is crucial for environments without internet access or for reproducible security audits.

Offline Scanning Workflow

Step 1: Verify Database Existence

Before scanning, ensure the offline database is available. In this environment, it is usually located in .cache/trivy/db/.

Step 2: Construct Trivy Command

Key flags for offline scanning:

Flag	Purpose
fs <target>	Scan filesystem/file (e.g., package-lock.json)
--format json	Output in JSON format for parsing
--output <file>	Save results to file
--scanners vuln	Scan only for vulnerabilities
--skip-db-update	Do not update database
--offline-scan	Enable offline mode
--cache-dir <path>	Path to pre-downloaded database

Example Command

trivy fs package-lock.json \
  --format json \
  --output trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --cache-dir .cache/trivy

JSON Output Structure

Trivy outputs vulnerability data in this format:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 }
          }
        }
      ]
    }
  ]
}