feat: add security audit automation scripts and detailed vulnerability documentation

هذا الالتزام موجود في:
2026-08-20 20:13:14 +03:00
الأصل a7a479141b
التزام e635566bc5
12 ملفات معدلة مع 1617 إضافات و363 حذوفات

311
Scripts/adversarial_test.sh Normal file
عرض الملف

@@ -0,0 +1,311 @@
#!/bin/sh
BIN="/root/ghaymah-v2-test/gy-linux-amd64"
LOGFILE="/root/ghaymah-v2-test/adversarial_test_results.log"
TIMEOUT_CMD="timeout 5"
echo "=====================================================================" > "$LOGFILE"
echo " ADVERSARIAL SECURITY TEST SUITE — $(date)" >> "$LOGFILE"
echo " Binary: $BIN" >> "$LOGFILE"
echo " Note: All tests run OFFLINE with 5s timeout to avoid server hangs" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
TOTAL=0
PASS=0
FAIL=0
FINDINGS=""
log_test() {
TOTAL=$((TOTAL + 1))
TEST_NAME="$1"
EXPECTED="$2"
OUTPUT="$3"
EXIT_CODE="$4"
echo "" >> "$LOGFILE"
echo "--- TEST $TOTAL: $TEST_NAME ---" >> "$LOGFILE"
echo "Exit Code: $EXIT_CODE" >> "$LOGFILE"
echo "Expected: $EXPECTED" >> "$LOGFILE"
echo "Output (first 300 chars):" >> "$LOGFILE"
printf '%.300s' "$OUTPUT" >> "$LOGFILE"
echo "" >> "$LOGFILE"
if echo "$OUTPUT" | grep -qiE "(panic|runtime error|segmentation fault|nil pointer dereference|SIGSEGV|goroutine [0-9]+ \[)"; then
echo "RESULT: *** CRASH/PANIC DETECTED ***" >> "$LOGFILE"
FAIL=$((FAIL + 1))
FINDINGS="$FINDINGS\n[CRASH] TEST $TOTAL: $TEST_NAME"
else
echo "RESULT: No crash (exit $EXIT_CODE)" >> "$LOGFILE"
PASS=$((PASS + 1))
fi
}
echo "Phase 1/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 1: PATH TRAVERSAL via deploy PATH arg =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy ../../../etc/passwd --no-auto-update 2>&1)
log_test "deploy ../../../etc/passwd" "reject or error" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy /etc/shadow --no-auto-update 2>&1)
log_test "deploy /etc/shadow" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy /proc/self/environ --no-auto-update 2>&1)
log_test "deploy /proc/self/environ" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile ../../../etc/passwd --no-auto-update 2>&1)
log_test "dockerfile flag path traversal to /etc/passwd" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile /proc/self/cmdline --no-auto-update 2>&1)
log_test "dockerfile flag /proc/self/cmdline" "reject" "$OUT" "$?"
echo "Phase 2/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 2: STDIN / -f flag INJECTION =====" >> "$LOGFILE"
OUT=$(echo '{"app":"../../etc/passwd","port":8080}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin JSON with traversal app name" "reject" "$OUT" "$?"
OUT=$(echo 'NOT_JSON' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin malformed non-JSON" "error gracefully" "$OUT" "$?"
OUT=$(echo '{"app":"x","port":"NOTANUM"}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin JSON string port" "error gracefully" "$OUT" "$?"
OUT=$(echo '' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin empty input" "error gracefully" "$OUT" "$?"
echo "Phase 3/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 3: NUMERIC BOUNDARY / OVERFLOW =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy --port 99999999 --no-auto-update 2>&1)
log_test "port 99999999 (overflow)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port -1 --no-auto-update 2>&1)
log_test "port -1 (negative)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 0 --no-auto-update 2>&1)
log_test "port 0" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 65536 --no-auto-update 2>&1)
log_test "port 65536 (above TCP max)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 2147483647 --no-auto-update 2>&1)
log_test "port INT32_MAX" "reject" "$OUT" "$?"
echo "Phase 4/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 4: LONG STRING / BUFFER OVERFLOW =====" >> "$LOGFILE"
LONG5K=$(dd if=/dev/urandom bs=1 count=5000 2>/dev/null | tr -dc 'a-zA-Z0-9')
OUT=$($TIMEOUT_CMD $BIN deploy --name "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --name 5000 char string" "reject or truncate" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --domain 5000 char string" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --tier "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --tier 5000 char string" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --ai-key "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --ai-key 5000 char string" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email "$LONG5K" --password "$LONG5K" --no-auto-update 2>&1)
log_test "login --email/password 5000 chars" "reject" "$OUT" "$?"
echo "Phase 5/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 5: COMMAND INJECTION VIA FLAGS =====" >> "$LOGFILE"
for payload in ';id' '$(whoami)' '`id`' '|cat /etc/passwd' '&&ls' '||id'; do
OUT=$($TIMEOUT_CMD $BIN deploy --name "$payload" --no-auto-update 2>&1)
log_test "deploy --name injection: $payload" "not execute cmd" "$OUT" "$?"
done
for payload in ';id' '$(whoami)' '`id`'; do
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$payload" --no-auto-update 2>&1)
log_test "deploy --domain injection: $payload" "not execute cmd" "$OUT" "$?"
done
for payload in ';id' '$(whoami)' '`id`'; do
OUT=$($TIMEOUT_CMD $BIN deploy --project "$payload" --no-auto-update 2>&1)
log_test "deploy --project injection: $payload" "not execute cmd" "$OUT" "$?"
done
echo "Phase 6/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 6: SYMLINK ATTACKS =====" >> "$LOGFILE"
TMPDIR=$(mktemp -d)
ln -sf /etc/passwd "$TMPDIR/Dockerfile"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ Dockerfile->symlink /etc/passwd" "not leak file" "$OUT" "$?"
ln -sf /etc/shadow "$TMPDIR/.env"
echo '{}' > "$TMPDIR/.gy.json"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ .env->symlink /etc/shadow" "not upload" "$OUT" "$?"
ln -sf /root "$TMPDIR/subdir"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ symlink subdir->root" "not traverse" "$OUT" "$?"
rm -rf "$TMPDIR"
echo "Phase 7/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 7: UNICODE / SPECIAL CHARS =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy --name "تطبيق-عربي" --no-auto-update 2>&1)
log_test "deploy --name Arabic chars" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name "app%00name" --no-auto-update 2>&1)
log_test "deploy --name null byte URL encoding" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '../../../tmp/evil' --no-auto-update 2>&1)
log_test "deploy --name path traversal" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '"><script>alert(1)</script>' --no-auto-update 2>&1)
log_test "deploy --name XSS payload" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '{{.Env.HOME}}' --no-auto-update 2>&1)
log_test "deploy --name Go template injection" "handle" "$OUT" "$?"
echo "Phase 8/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 8: ENVIRONMENT VARIABLE POISONING =====" >> "$LOGFILE"
OUT=$(HOME=/tmp $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with HOME=/tmp" "handle" "$OUT" "$?"
OUT=$(XDG_CONFIG_HOME=/tmp/evil $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with XDG_CONFIG_HOME=/tmp/evil" "handle" "$OUT" "$?"
OUT=$(GY_AI_KEY="malicious-key-value" $TIMEOUT_CMD $BIN deploy --name test --no-auto-update 2>&1)
log_test "deploy with GY_AI_KEY env set" "not leak key" "$OUT" "$?"
echo "Phase 9/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 9: HTTP PROXY MAN-IN-THE-MIDDLE =====" >> "$LOGFILE"
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN login --email test@test.com --password testpass --no-auto-update 2>&1)
log_test "login with evil HTTP/HTTPS_PROXY" "check if creds sent to proxy" "$OUT" "$?"
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with evil HTTP_PROXY" "check if token sent to proxy" "$OUT" "$?"
echo "Phase 10/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 10: CREDENTIAL INPUT ATTACKS =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN login --email "admin@ghaymah.systems" --password "' OR '1'='1" --no-auto-update 2>&1)
log_test "login SQL injection in password" "not succeed" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email '<script>alert(1)</script>' --password test --no-auto-update 2>&1)
log_test "login XSS in email" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email "" --password "" --no-auto-update 2>&1)
log_test "login empty email+password" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN signup --no-auto-update 2>&1)
log_test "signup command without args" "handle" "$OUT" "$?"
echo "Phase 11/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 11: DELETE COMMAND ABUSE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN delete app "../../../etc" --force --no-auto-update 2>&1)
log_test "delete app path traversal name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete app "" --force --no-auto-update 2>&1)
log_test "delete app empty name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete project "*" --force --no-auto-update 2>&1)
log_test "delete project wildcard" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete app --force --no-auto-update 2>&1)
log_test "delete app no name given" "reject" "$OUT" "$?"
echo "Phase 12/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 12: TUNNEL ABUSE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN tunnel start "evil;id" --port 3000 --no-auto-update 2>&1)
log_test "tunnel start injection in name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port 0 --no-auto-update 2>&1)
log_test "tunnel start port 0" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port -1 --no-auto-update 2>&1)
log_test "tunnel start port -1" "reject" "$OUT" "$?"
echo "Phase 13/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 13: DEBUG MODE INFORMATION LEAKAGE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN whoami --debug --no-auto-update 2>&1)
log_test "whoami --debug info leakage" "check secret disclosure" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN config --debug --no-auto-update 2>&1)
log_test "config --debug info leakage" "check secret disclosure" "$OUT" "$?"
echo "Phase 14/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 14: COMPLETION SCRIPT INJECTION =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN completion bash --no-auto-update 2>&1 | head -n 30)
log_test "bash completion script output" "check injection vectors" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN completion zsh --no-auto-update 2>&1 | head -n 30)
log_test "zsh completion script output" "check injection vectors" "$OUT" "$?"
echo "Phase 15/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 15: .gy.json POISONING =====" >> "$LOGFILE"
TMPDIR2=$(mktemp -d)
echo '{"app":"test","port":8080,"env":{"EVIL":"$(cat /etc/passwd)","SHELL_INJECT":"; rm -rf /","LONG_VAL":"'"$(dd if=/dev/urandom bs=1 count=8000 2>/dev/null | tr -dc 'a-zA-Z0-9')"'"}}' > "$TMPDIR2/.gy.json"
echo 'FROM nginx:latest' > "$TMPDIR2/Dockerfile"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with poisoned .gy.json env values" "not execute commands" "$OUT" "$?"
echo '{"app":99999,"port":"EVIL","publicAccess":{"enabled":"NOTBOOL"}}' > "$TMPDIR2/.gy.json"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with wrong-type .gy.json fields" "error gracefully" "$OUT" "$?"
echo 'INVALID JSON {{{' > "$TMPDIR2/.gy.json"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with completely broken .gy.json" "error gracefully" "$OUT" "$?"
rm -rf "$TMPDIR2"
echo "" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
echo "FINAL SUMMARY" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
echo "Total Tests: $TOTAL" >> "$LOGFILE"
echo "Passed (no crash): $PASS" >> "$LOGFILE"
echo "Failed (crash/panic): $FAIL" >> "$LOGFILE"
if [ -n "$FINDINGS" ]; then
echo "" >> "$LOGFILE"
echo "CRITICAL FINDINGS:" >> "$LOGFILE"
printf "$FINDINGS" >> "$LOGFILE"
echo "" >> "$LOGFILE"
fi
echo "=====================================================================" >> "$LOGFILE"
echo "" >> "$LOGFILE"
echo "Test run complete at $(date)" >> "$LOGFILE"
cat "$LOGFILE"

عرض الملف

@@ -0,0 +1,311 @@
#!/bin/sh
BIN="/root/ghaymah-v2-test/gy-linux-amd64"
LOGFILE="/root/ghaymah-v2-test/adversarial_test_results.log"
TIMEOUT_CMD="timeout 5"
echo "=====================================================================" > "$LOGFILE"
echo " ADVERSARIAL SECURITY TEST SUITE — $(date)" >> "$LOGFILE"
echo " Binary: $BIN" >> "$LOGFILE"
echo " Note: All tests run OFFLINE with 5s timeout to avoid server hangs" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
TOTAL=0
PASS=0
FAIL=0
FINDINGS=""
log_test() {
TOTAL=$((TOTAL + 1))
TEST_NAME="$1"
EXPECTED="$2"
OUTPUT="$3"
EXIT_CODE="$4"
echo "" >> "$LOGFILE"
echo "--- TEST $TOTAL: $TEST_NAME ---" >> "$LOGFILE"
echo "Exit Code: $EXIT_CODE" >> "$LOGFILE"
echo "Expected: $EXPECTED" >> "$LOGFILE"
echo "Output (first 300 chars):" >> "$LOGFILE"
printf '%.300s' "$OUTPUT" >> "$LOGFILE"
echo "" >> "$LOGFILE"
if echo "$OUTPUT" | grep -qiE "(panic|runtime error|segmentation fault|nil pointer dereference|SIGSEGV|goroutine [0-9]+ \[)"; then
echo "RESULT: *** CRASH/PANIC DETECTED ***" >> "$LOGFILE"
FAIL=$((FAIL + 1))
FINDINGS="$FINDINGS\n[CRASH] TEST $TOTAL: $TEST_NAME"
else
echo "RESULT: No crash (exit $EXIT_CODE)" >> "$LOGFILE"
PASS=$((PASS + 1))
fi
}
echo "Phase 1/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 1: PATH TRAVERSAL via deploy PATH arg =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy ../../../etc/passwd --no-auto-update 2>&1)
log_test "deploy ../../../etc/passwd" "reject or error" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy /etc/shadow --no-auto-update 2>&1)
log_test "deploy /etc/shadow" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy /proc/self/environ --no-auto-update 2>&1)
log_test "deploy /proc/self/environ" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile ../../../etc/passwd --no-auto-update 2>&1)
log_test "dockerfile flag path traversal to /etc/passwd" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --dockerfile /proc/self/cmdline --no-auto-update 2>&1)
log_test "dockerfile flag /proc/self/cmdline" "reject" "$OUT" "$?"
echo "Phase 2/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 2: STDIN / -f flag INJECTION =====" >> "$LOGFILE"
OUT=$(echo '{"app":"../../etc/passwd","port":8080}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin JSON with traversal app name" "reject" "$OUT" "$?"
OUT=$(echo 'NOT_JSON' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin malformed non-JSON" "error gracefully" "$OUT" "$?"
OUT=$(echo '{"app":"x","port":"NOTANUM"}' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin JSON string port" "error gracefully" "$OUT" "$?"
OUT=$(echo '' | $TIMEOUT_CMD $BIN deploy -f - --no-auto-update 2>&1)
log_test "stdin empty input" "error gracefully" "$OUT" "$?"
echo "Phase 3/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 3: NUMERIC BOUNDARY / OVERFLOW =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy --port 99999999 --no-auto-update 2>&1)
log_test "port 99999999 (overflow)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port -1 --no-auto-update 2>&1)
log_test "port -1 (negative)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 0 --no-auto-update 2>&1)
log_test "port 0" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 65536 --no-auto-update 2>&1)
log_test "port 65536 (above TCP max)" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --port 2147483647 --no-auto-update 2>&1)
log_test "port INT32_MAX" "reject" "$OUT" "$?"
echo "Phase 4/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 4: LONG STRING / BUFFER OVERFLOW =====" >> "$LOGFILE"
LONG5K=$(dd if=/dev/urandom bs=1 count=5000 2>/dev/null | tr -dc 'a-zA-Z0-9')
OUT=$($TIMEOUT_CMD $BIN deploy --name "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --name 5000 char string" "reject or truncate" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --domain 5000 char string" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --tier "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --tier 5000 char string" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --ai-key "$LONG5K" --no-auto-update 2>&1)
log_test "deploy --ai-key 5000 char string" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email "$LONG5K" --password "$LONG5K" --no-auto-update 2>&1)
log_test "login --email/password 5000 chars" "reject" "$OUT" "$?"
echo "Phase 5/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 5: COMMAND INJECTION VIA FLAGS =====" >> "$LOGFILE"
for payload in ';id' '$(whoami)' '`id`' '|cat /etc/passwd' '&&ls' '||id'; do
OUT=$($TIMEOUT_CMD $BIN deploy --name "$payload" --no-auto-update 2>&1)
log_test "deploy --name injection: $payload" "not execute cmd" "$OUT" "$?"
done
for payload in ';id' '$(whoami)' '`id`'; do
OUT=$($TIMEOUT_CMD $BIN deploy --domain "$payload" --no-auto-update 2>&1)
log_test "deploy --domain injection: $payload" "not execute cmd" "$OUT" "$?"
done
for payload in ';id' '$(whoami)' '`id`'; do
OUT=$($TIMEOUT_CMD $BIN deploy --project "$payload" --no-auto-update 2>&1)
log_test "deploy --project injection: $payload" "not execute cmd" "$OUT" "$?"
done
echo "Phase 6/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 6: SYMLINK ATTACKS =====" >> "$LOGFILE"
TMPDIR=$(mktemp -d)
ln -sf /etc/passwd "$TMPDIR/Dockerfile"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ Dockerfile->symlink /etc/passwd" "not leak file" "$OUT" "$?"
ln -sf /etc/shadow "$TMPDIR/.env"
echo '{}' > "$TMPDIR/.gy.json"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ .env->symlink /etc/shadow" "not upload" "$OUT" "$?"
ln -sf /root "$TMPDIR/subdir"
OUT=$($TIMEOUT_CMD $BIN deploy "$TMPDIR" --no-auto-update 2>&1)
log_test "deploy dir w/ symlink subdir->root" "not traverse" "$OUT" "$?"
rm -rf "$TMPDIR"
echo "Phase 7/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 7: UNICODE / SPECIAL CHARS =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN deploy --name "تطبيق-عربي" --no-auto-update 2>&1)
log_test "deploy --name Arabic chars" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name "app%00name" --no-auto-update 2>&1)
log_test "deploy --name null byte URL encoding" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '../../../tmp/evil' --no-auto-update 2>&1)
log_test "deploy --name path traversal" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '"><script>alert(1)</script>' --no-auto-update 2>&1)
log_test "deploy --name XSS payload" "handle" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN deploy --name '{{.Env.HOME}}' --no-auto-update 2>&1)
log_test "deploy --name Go template injection" "handle" "$OUT" "$?"
echo "Phase 8/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 8: ENVIRONMENT VARIABLE POISONING =====" >> "$LOGFILE"
OUT=$(HOME=/tmp $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with HOME=/tmp" "handle" "$OUT" "$?"
OUT=$(XDG_CONFIG_HOME=/tmp/evil $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with XDG_CONFIG_HOME=/tmp/evil" "handle" "$OUT" "$?"
OUT=$(GY_AI_KEY="malicious-key-value" $TIMEOUT_CMD $BIN deploy --name test --no-auto-update 2>&1)
log_test "deploy with GY_AI_KEY env set" "not leak key" "$OUT" "$?"
echo "Phase 9/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 9: HTTP PROXY MAN-IN-THE-MIDDLE =====" >> "$LOGFILE"
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN login --email test@test.com --password testpass --no-auto-update 2>&1)
log_test "login with evil HTTP/HTTPS_PROXY" "check if creds sent to proxy" "$OUT" "$?"
OUT=$(HTTP_PROXY=http://evil-proxy:8080 HTTPS_PROXY=http://evil-proxy:8080 $TIMEOUT_CMD $BIN whoami --no-auto-update 2>&1)
log_test "whoami with evil HTTP_PROXY" "check if token sent to proxy" "$OUT" "$?"
echo "Phase 10/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 10: CREDENTIAL INPUT ATTACKS =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN login --email "admin@ghaymah.systems" --password "' OR '1'='1" --no-auto-update 2>&1)
log_test "login SQL injection in password" "not succeed" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email '<script>alert(1)</script>' --password test --no-auto-update 2>&1)
log_test "login XSS in email" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN login --email "" --password "" --no-auto-update 2>&1)
log_test "login empty email+password" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN signup --no-auto-update 2>&1)
log_test "signup command without args" "handle" "$OUT" "$?"
echo "Phase 11/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 11: DELETE COMMAND ABUSE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN delete app "../../../etc" --force --no-auto-update 2>&1)
log_test "delete app path traversal name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete app "" --force --no-auto-update 2>&1)
log_test "delete app empty name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete project "*" --force --no-auto-update 2>&1)
log_test "delete project wildcard" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN delete app --force --no-auto-update 2>&1)
log_test "delete app no name given" "reject" "$OUT" "$?"
echo "Phase 12/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 12: TUNNEL ABUSE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN tunnel start "evil;id" --port 3000 --no-auto-update 2>&1)
log_test "tunnel start injection in name" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port 0 --no-auto-update 2>&1)
log_test "tunnel start port 0" "reject" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN tunnel start test --port -1 --no-auto-update 2>&1)
log_test "tunnel start port -1" "reject" "$OUT" "$?"
echo "Phase 13/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 13: DEBUG MODE INFORMATION LEAKAGE =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN whoami --debug --no-auto-update 2>&1)
log_test "whoami --debug info leakage" "check secret disclosure" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN config --debug --no-auto-update 2>&1)
log_test "config --debug info leakage" "check secret disclosure" "$OUT" "$?"
echo "Phase 14/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 14: COMPLETION SCRIPT INJECTION =====" >> "$LOGFILE"
OUT=$($TIMEOUT_CMD $BIN completion bash --no-auto-update 2>&1 | head -n 30)
log_test "bash completion script output" "check injection vectors" "$OUT" "$?"
OUT=$($TIMEOUT_CMD $BIN completion zsh --no-auto-update 2>&1 | head -n 30)
log_test "zsh completion script output" "check injection vectors" "$OUT" "$?"
echo "Phase 15/15 starting..." >&2
echo "" >> "$LOGFILE"
echo "===== PHASE 15: .gy.json POISONING =====" >> "$LOGFILE"
TMPDIR2=$(mktemp -d)
echo '{"app":"test","port":8080,"env":{"EVIL":"$(cat /etc/passwd)","SHELL_INJECT":"; rm -rf /","LONG_VAL":"'"$(dd if=/dev/urandom bs=1 count=8000 2>/dev/null | tr -dc 'a-zA-Z0-9')"'"}}' > "$TMPDIR2/.gy.json"
echo 'FROM nginx:latest' > "$TMPDIR2/Dockerfile"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with poisoned .gy.json env values" "not execute commands" "$OUT" "$?"
echo '{"app":99999,"port":"EVIL","publicAccess":{"enabled":"NOTBOOL"}}' > "$TMPDIR2/.gy.json"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with wrong-type .gy.json fields" "error gracefully" "$OUT" "$?"
echo 'INVALID JSON {{{' > "$TMPDIR2/.gy.json"
OUT=$($TIMEOUT_CMD $BIN config --no-auto-update 2>&1)
log_test "config with completely broken .gy.json" "error gracefully" "$OUT" "$?"
rm -rf "$TMPDIR2"
echo "" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
echo "FINAL SUMMARY" >> "$LOGFILE"
echo "=====================================================================" >> "$LOGFILE"
echo "Total Tests: $TOTAL" >> "$LOGFILE"
echo "Passed (no crash): $PASS" >> "$LOGFILE"
echo "Failed (crash/panic): $FAIL" >> "$LOGFILE"
if [ -n "$FINDINGS" ]; then
echo "" >> "$LOGFILE"
echo "CRITICAL FINDINGS:" >> "$LOGFILE"
printf "$FINDINGS" >> "$LOGFILE"
echo "" >> "$LOGFILE"
fi
echo "=====================================================================" >> "$LOGFILE"
echo "" >> "$LOGFILE"
echo "Test run complete at $(date)" >> "$LOGFILE"
cat "$LOGFILE"

27
Scripts/fuzz_runner.sh Normal file
عرض الملف

@@ -0,0 +1,27 @@
#!/bin/sh
BIN="/root/ghaymah-v2-test/gy-linux-amd64"
echo "=== Starting CLI Flag Fuzzing Audit ==="
COMMANDS="deploy config login list logs tunnel info delete"
FLAGS="--file --json --debug --no-auto-update"
TESTS=0
PANICS=0
for cmd in $COMMANDS; do
for flag in $FLAGS; do
for p in ";id" "&&ls" "|cat /etc/passwd" '$(whoami)' "NULL_BYTE_\x00" "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; do
TESTS=$((TESTS + 1))
OUT=$($BIN $cmd $flag "$p" 2>&1)
if echo "$OUT" | grep -qiE "(panic|runtime error|segmentation fault|nil pointer)"; then
echo "[CRITICAL PANIC DETECTED] gy $cmd $flag '$p'"
echo "Output snippet: $(echo "$OUT" | head -n 3)"
PANICS=$((PANICS + 1))
fi
done
done
done
echo "=== Flag Fuzzing Completed ==="
echo "Total tests run: $TESTS"
echo "Total panics observed: $PANICS"

81
Scripts/git_init.sh Normal file
عرض الملف

@@ -0,0 +1,81 @@
#!/bin/sh
# ============================================================================
# Ghaymah CLI v2 Audit — Git Initialization Script
# Author : Ziad Mahmoud Ahmed Abdelgwad
# Usage : sh git_init.sh
# ============================================================================
set -eu
WORKSPACE="/root/ghaymah-v2-test"
cd "$WORKSPACE"
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ Ghaymah CLI v2 — Git Repository Initialization ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
# ── Step 1: Initialize the repository ────────────────────────────────────────
echo "[1/4] Initializing Git repository..."
git init
echo " ✔ Git repository initialized"
# ── Step 2: Configure Git identity (adjust as needed) ────────────────────────
echo ""
echo "[2/4] Configuring Git identity..."
git config user.name "Ziad Mahmoud Ahmed Abdelgwad"
git config user.email "your-email@example.com"
echo " ✔ Git user configured"
echo " ⚠ Update user.email if needed: git config user.email \"you@example.com\""
# ── Step 3: Stage all files ──────────────────────────────────────────────────
echo ""
echo "[3/4] Staging files..."
git add -A
echo " ✔ All files staged"
echo ""
echo " Files staged (excluding .gitignore patterns):"
git status --short
# ── Step 4: Initial commit ───────────────────────────────────────────────────
echo ""
echo "[4/4] Creating initial commit..."
git commit -m "🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository
Comprehensive security audit of the Ghaymah CLI v2 and web platform.
Findings:
- [CRITICAL] T1552: Dockerfile & .env Credential Leakage
- [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
- [HIGH] T1539: Session Token Revocation Bypass
- [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)
Includes:
- 8 Proof-of-Concept applications (PoC_Apps/)
- Visual evidence & screenshots (Assets/Screenshots/)
- Full PDF audit report (Reports/)
- Mermaid.js attack flow diagrams in README
Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist"
echo ""
echo " ✔ Initial commit created"
# ── Post-init instructions ───────────────────────────────────────────────────
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ ✅ Repository initialized successfully! ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo " Next steps — Add your remote and push:"
echo ""
echo " git remote add origin https://github.com/gitpasha/ghaymah-v2-test.git"
echo " git branch -M main"
echo " git push -u origin main"
echo ""
echo " Or if using SSH:"
echo ""
echo " git remote add origin git@github.com:gitpasha/ghaymah-v2-test.git"
echo " git branch -M main"
echo " git push -u origin main"
echo ""

161
Scripts/organize.sh Normal file
عرض الملف

@@ -0,0 +1,161 @@
#!/bin/bash
# ============================================================================
# Ghaymah CLI v2 — Audit Workspace Organizer
# Author : Ziad Mahmoud Ahmed Abdelgwad
# Date : 2026-08-19
# Purpose: Restructure the raw audit workspace into a clean, professional
# directory layout suitable for version control and publication.
# ============================================================================
set -euo pipefail
WORKSPACE="/root/ghaymah-v2-test"
cd "$WORKSPACE"
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ Ghaymah CLI v2 — Workspace Organizer ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
# ── Step 1: Create the target directory structure ────────────────────────────
echo "[1/5] Creating directory structure..."
mkdir -p PoC_Apps
mkdir -p Assets/Screenshots
mkdir -p Reports
echo " ✔ PoC_Apps/"
echo " ✔ Assets/Screenshots/"
echo " ✔ Reports/"
# ── Step 2: Move all PoC application folders into PoC_Apps ───────────────────
echo ""
echo "[2/5] Moving PoC application folders → PoC_Apps/"
for dir in test-app test-app-2 test-app-3 test-app-5 test-app-clean test-app-final; do
if [ -d "$dir" ]; then
mv "$dir" PoC_Apps/
echo "$dir → PoC_Apps/$dir"
else
echo "$dir not found, skipping."
fi
done
for dir in broken-docker-test invalid-docker-test; do
if [ -d "$dir" ]; then
mv "$dir" PoC_Apps/
echo "$dir → PoC_Apps/$dir"
else
echo "$dir not found, skipping."
fi
done
# ── Step 3: Migrate screenshots ─────────────────────────────────────────────
echo ""
echo "[3/5] Migrating screenshots → Assets/Screenshots/"
if [ -d "screenshoots" ]; then
# Copy contents into the properly-named directory
cp -r screenshoots/* Assets/Screenshots/ 2>/dev/null || true
# Remove the old misspelled directory
rm -rf screenshoots
echo " ✔ screenshoots/* → Assets/Screenshots/"
echo " ✔ Removed old 'screenshoots' directory"
else
echo " ⚠ screenshoots/ not found, skipping."
fi
# Rename screenshot files with cleaner names (spaces → underscores)
cd Assets/Screenshots
for f in *; do
clean_name=$(echo "$f" | tr ' ' '_')
if [ "$f" != "$clean_name" ]; then
mv "$f" "$clean_name"
echo " ✔ Renamed: $f$clean_name"
fi
done
cd "$WORKSPACE"
# ── Step 4: Move the audit report ───────────────────────────────────────────
echo ""
echo "[4/5] Moving audit report → Reports/"
if [ -f "Ghaymah_CLI_v2_Audit_Report.pdf" ]; then
mv Ghaymah_CLI_v2_Audit_Report.pdf Reports/
echo " ✔ Ghaymah_CLI_v2_Audit_Report.pdf → Reports/"
fi
# Clean up Zone.Identifier files (Windows artifact)
find . -name "*.Zone.Identifier" -delete 2>/dev/null || true
echo " ✔ Cleaned up .Zone.Identifier files"
# ── Step 5: Generate .gitignore ──────────────────────────────────────────────
echo ""
echo "[5/5] Generating .gitignore..."
cat > .gitignore << 'GITIGNORE'
# ============================================================================
# Ghaymah CLI v2 Audit — .gitignore
# ============================================================================
# ── CLI Binary (large / proprietary) ────────────────────────────────────────
gy-linux-amd64
# ── Windows Zone.Identifier metadata ────────────────────────────────────────
*.Zone.Identifier
*:Zone.Identifier
# ── Sensitive environment files ─────────────────────────────────────────────
.env
.env.*
!.env.example
# ── OS-generated files ──────────────────────────────────────────────────────
.DS_Store
Thumbs.db
Desktop.ini
# ── IDE / Editor files ──────────────────────────────────────────────────────
.vscode/
.idea/
*.swp
*.swo
*~
# ── Node / build artifacts ──────────────────────────────────────────────────
node_modules/
dist/
build/
*.log
GITIGNORE
echo " ✔ .gitignore created"
# ── Summary ──────────────────────────────────────────────────────────────────
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ ✅ Workspace organization complete! ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo "Final structure:"
echo ""
echo " ghaymah-v2-test/"
echo " ├── Assets/"
echo " │ └── Screenshots/"
echo " │ ├── docker.png"
echo " │ ├── env.png"
echo " │ ├── logs.png"
echo " │ └── Screenshot_*.png"
echo " ├── PoC_Apps/"
echo " │ ├── test-app/"
echo " │ ├── test-app-2/"
echo " │ ├── test-app-3/"
echo " │ ├── test-app-5/"
echo " │ ├── test-app-clean/"
echo " │ ├── test-app-final/"
echo " │ ├── broken-docker-test/"
echo " │ └── invalid-docker-test/"
echo " ├── Reports/"
echo " │ └── Ghaymah_CLI_v2_Audit_Report.pdf"
echo " ├── .gitignore"
echo " ├── organize.sh"
echo " └── README.md"
echo ""