feat: complete multi-microservice project deployment, internal DNS, raw TCP and security penetration report
This commit is contained in:
@@ -1,21 +1,30 @@
|
||||
# Ghaymah Systems — Private Networking & Internal DNS Testing Suite
|
||||
# Ghaymah Systems — Private Networking, Internal DNS & Multi-Microservice Testing Suite
|
||||
|
||||
Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
|
||||
Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
|
||||
|
||||
## 📋 Full Assessment Report
|
||||
Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures:
|
||||
👉 **[GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
|
||||
## 📋 Assessment Reports
|
||||
|
||||
1. 👉 **[Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)](reports/GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md)**
|
||||
* Complete SOC multi-service topology: Edge Gateway, Private REST Backend, Private Redis Database, and Diagnostic Pod.
|
||||
* Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
|
||||
2. 👉 **[Internal DNS & Private Networking Report (Project: dns-tcp-test)](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
|
||||
* Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Scope & Objectives
|
||||
1. **Internal DNS Verification**: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS `10.43.0.10:53`) using deterministic uniqueName identifiers (`[app-name]-[hash]`).
|
||||
2. **Raw TCP Connectivity**: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (`test-redis` on port 6379).
|
||||
3. **Security & Penetration Testing**:
|
||||
- Cross-project lateral movement assessment within the same tenant.
|
||||
- Cross-tenant and cluster infrastructure isolation verification.
|
||||
- Network enumeration and port scanning.
|
||||
- Dual routing and DNS leak detection.
|
||||
1. **Multi-Microservice Architecture**: Deploy a real 4-tier microservice application directly on Ghaymah:
|
||||
- `soc-gateway`: Public edge ingress, reverse proxy, and UI dashboard.
|
||||
- `soc-backend`: Private analysis engine listening on port 4000.
|
||||
- `soc-redis`: Private threat intelligence database & cache on port 6379.
|
||||
- `soc-tester`: Live DevSecOps testing pod.
|
||||
2. **Internal DNS Verification**: Verify container-to-container service discovery via CoreDNS (`10.43.0.10:53`) using deterministic unique names (`[name]-[hash]`).
|
||||
3. **Raw TCP Socket Connectivity**: Validate non-HTTP socket communication over port 6379 (Redis handshake, write, read, atomic counters).
|
||||
4. **Security & Penetration Testing**:
|
||||
- Assess intra-tenant cross-project lateral movement.
|
||||
- Verify cluster infrastructure isolation (Kubernetes API, Cloud Metadata SSRF).
|
||||
- Local subnet discovery & port scanning.
|
||||
- Outbound egress NAT and DNS leak behavior.
|
||||
|
||||
---
|
||||
|
||||
@@ -23,47 +32,51 @@ Read the full report with architecture diagrams, raw evidence, and vulnerability
|
||||
|
||||
```text
|
||||
├── reports/
|
||||
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Final assessment report
|
||||
│ ├── GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md # Multi-microservice SOC assessment report
|
||||
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Initial DNS & TCP baseline report
|
||||
├── logs/
|
||||
│ ├── ghaymah_execution.log # Complete end-to-end execution log
|
||||
│ ├── uniquename_dns_tcp.log # Targeted uniqueName resolution & TCP test log
|
||||
│ ├── ghaymah_test_results.json # Structured test results
|
||||
│ ├── 01_api_recon.md # Phase 2 API discovery
|
||||
│ └── 02_mcp_discovery.md # MCP tools discovery
|
||||
│ ├── soc_multiservice_execution.log # Multi-microservice execution log
|
||||
│ ├── soc_multiservice_results.json # Structured test results (JSON)
|
||||
│ ├── ghaymah_execution.log # Baseline test execution log
|
||||
│ └── uniquename_dns_tcp.log # Raw TCP test log
|
||||
├── scripts/
|
||||
│ ├── run_comprehensive_ghaymah_tests.js # End-to-end automated test runner
|
||||
│ ├── test_uniquename_dns_tcp.js # Targeted DNS & TCP verification script
|
||||
│ ├── remote_exec.js # WebSocket terminal execution client
|
||||
│ ├── deploy_redis.js # Deploys private Redis container
|
||||
│ ├── deploy_terminal.js # Deploys diagnostic terminal container
|
||||
│ ├── build_and_deploy_apps.js # Artifact build & deployment pipeline
|
||||
│ └── auth_manager.js # Token management & caching
|
||||
└── sample_artifact.tar.gz # Reference Ghaymah build artifact
|
||||
│ ├── create_soc_microservices_project.js # Deploys the multi-microservice project
|
||||
│ ├── run_soc_multiservice_tests.js # Automated multi-service test runner
|
||||
│ ├── monitor_soc_project.js # Deployment status polling
|
||||
│ ├── remote_exec.js # WebSocket terminal execution client
|
||||
│ ├── test_soc_redis_tcp.js # Raw TCP protocol tester
|
||||
│ └── auth_manager.js # Ghaymah authentication manager
|
||||
├── soc_project_topology.json # Full project resource definition & metadata
|
||||
└── token.json # Authenticated session token (auto-managed)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📊 Summary of Findings
|
||||
## 📊 Summary of Findings Matrix
|
||||
|
||||
| Test Area | Target | Status | Notes |
|
||||
| :--- | :--- | :---: | :--- |
|
||||
| **Internal DNS** | `test-redis-feccbaec5bd7` | **PASS** | Resolves to `10.42.5.97` via CoreDNS |
|
||||
| **Raw TCP** | `test-redis:6379` | **PASS** | `PING` $\rightarrow$ `+PONG`, `SET` $\rightarrow$ `+OK` |
|
||||
| **Tenant Isolation** | Cluster infrastructure / External tenants | **PASS** | `NXDOMAIN` / Timeouts for non-tenant resources |
|
||||
| **Project Isolation** | `auth-deploy-4c0bca85312b` (Separate project) | **FINDING** | **MEDIUM/HIGH**: Intra-tenant cross-project traffic allowed |
|
||||
| **Internet Egress** | `httpbin.org/ip` | **PASS** | NAT Gateway active (`184.107.141.203`) |
|
||||
| **DNS Leaks** | Upstream resolver | **PASS** | No leakage of internal/mesh queries |
|
||||
| Test Domain | Target Service | Result | Classification | Key Observation |
|
||||
| :--- | :--- | :---: | :---: | :--- |
|
||||
| **Internal DNS** | `soc-redis-10f420c389ef` | **PASS** | Functional | Resolves to `10.42.5.99` via CoreDNS |
|
||||
| **Internal DNS** | `soc-backend-d1895c70f6b2`| **PASS** | Functional | Resolves to `10.42.5.103` via CoreDNS |
|
||||
| **Internal DNS** | `soc-gateway-28cd1dc4e034`| **PASS** | Functional | Resolves to `10.42.5.101` via CoreDNS |
|
||||
| **Raw TCP** | `soc-redis:6379` | **PASS** | Functional | `PING` $\rightarrow$ `+PONG`, `SET/GET` threat alerts verified |
|
||||
| **Inter-Service Mesh** | `soc-gateway` $\rightarrow$ `soc-redis` | **PASS** | Functional | Edge Gateway queries Database directly over mesh |
|
||||
| **Edge Ingress** | `soc-gateway` (Public URL) | **PASS** | Functional | HTTP 200 via `hosted.ghaymah.systems` |
|
||||
| **Database Isolation**| `soc-redis` (Public Access) | **PASS** | Secure | HTTP 404 / Blocked from public internet |
|
||||
| **Project Isolation**| Cross-project Redis/HTTP | **FINDING** | **Medium/High** | Projects in same account share flat mesh network |
|
||||
| **Cluster Boundary** | K8s API (`10.43.0.1:443`) | **PASS** | Secure | HTTP 401 Unauthorized (RBAC enforced) |
|
||||
| **SSRF / Cloud Meta** | AWS/Cloud Metadata (`169.254.169.254`) | **PASS** | Secure | Blocked / Unreachable |
|
||||
| **Cluster Telemetry** | CoreDNS Metrics (`10.43.0.10:9153`) | **INFO** | Low | Prometheus metrics exposed internally |
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Reproduction & Execution
|
||||
|
||||
To execute the tests against the live Ghaymah deployment:
|
||||
## 🚀 Execution & Verification
|
||||
|
||||
To run the automated multi-microservice tests:
|
||||
```bash
|
||||
# 1. Run targeted uniqueName verification
|
||||
node scripts/test_uniquename_dns_tcp.js
|
||||
# 1. Verify Authentication
|
||||
node scripts/auth_manager.js
|
||||
|
||||
# 2. Run full test suite
|
||||
node scripts/run_comprehensive_ghaymah_tests.js
|
||||
# 2. Run Comprehensive Test Suite
|
||||
node scripts/run_soc_multiservice_tests.js
|
||||
```
|
||||
|
||||
@@ -0,0 +1,194 @@
|
||||
[2026-10-12T20:58:47.468Z] [INIT] === Starting Comprehensive Multi-Microservice QA & Security Suite for Project: ===
|
||||
ghaymah-soc-microservices
|
||||
|
||||
[2026-10-12T20:58:48.820Z] [INIT] === Connected to soc-tester diagnostic container ===
|
||||
|
||||
|
||||
[2026-10-12T20:58:50.103Z] [INIT] === Connected to soc-gateway edge container ===
|
||||
|
||||
|
||||
[2026-10-12T20:58:50.104Z] [PHASE1-RECON] === Container Network & OS Information (soc-tester) ===
|
||||
|
||||
|
||||
[2026-10-12T20:58:50.447Z] [PHASE1-RECON] === OS Info ===
|
||||
Linux soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 Linux
|
||||
PRETTY_NAME="Alpine Linux v3.24"
|
||||
|
||||
[2026-10-12T20:58:50.587Z] [PHASE1-RECON] === IP & Network Interfaces ===
|
||||
2: eth0@if43495: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000
|
||||
link/ether ba:84:f8:4d:b1:8c brd ff:ff:ff:ff:ff:ff
|
||||
inet 10.42.5.102/24 brd 10.42.5.255 scope global eth0
|
||||
valid_lft forever preferred_lft forever
|
||||
|
||||
[2026-10-12T20:58:50.955Z] [PHASE1-RECON] === CoreDNS Resolver Configuration ===
|
||||
search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net
|
||||
nameserver 10.43.0.10
|
||||
options ndots:5
|
||||
|
||||
[2026-10-12T20:58:50.956Z] [PHASE2-DNS] === Internal DNS Resolution for Microservices ===
|
||||
|
||||
|
||||
[2026-10-12T20:58:51.853Z] [PHASE2-DNS] === nslookup soc-redis-10f420c389ef ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
Name: soc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.5.99
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
|
||||
[2026-10-12T20:58:52.754Z] [PHASE2-DNS] === nslookup soc-backend-d1895c70f6b2 ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
Name: soc-backend-d1895c70f6b2.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.5.103
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
|
||||
[2026-10-12T20:58:53.546Z] [PHASE2-DNS] === nslookup soc-gateway-28cd1dc4e034 ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
Name: soc-gateway-28cd1dc4e034.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.5.101
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
|
||||
[2026-10-12T20:59:05.562Z] [PHASE2-DNS] === dig +short soc-redis-10f420c389ef ===
|
||||
dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__
|
||||
␍__RET__0_wb05rp__END__
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
|
||||
|
||||
[2026-10-12T20:59:06.277Z] [PHASE2-DNS] === Reverse DNS PTR for dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__
|
||||
␍__RET__0_wb05rp__END__
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# ===
|
||||
bash: soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#: command not found
|
||||
|
||||
[2026-10-12T20:59:07.274Z] [PHASE2-DNS] === Negative DNS Lookup ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
** server can't find non-existent-service-mesh.local: NXDOMAIN
|
||||
|
||||
[2026-10-12T20:59:07.276Z] [PHASE3-TCP] === Raw TCP Socket Communication with soc-redis (Port 6379) ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:07.460Z] [PHASE3-TCP] === Raw TCP Port 6379 Probe ===
|
||||
soc-redis-10f420c389ef (10.42.5.99:6379) open
|
||||
|
||||
[2026-10-12T20:59:07.599Z] [PHASE3-TCP] === Raw TCP Redis PING ===
|
||||
+PONG
|
||||
|
||||
[2026-10-12T20:59:07.954Z] [PHASE3-TCP] === Raw TCP Write Threat Event ===
|
||||
+OK
|
||||
|
||||
[2026-10-12T20:59:08.099Z] [PHASE3-TCP] === Raw TCP Read Threat Event ===
|
||||
$35
|
||||
CRITICAL_RANSOMWARE_BLOCKED_ON_MESH
|
||||
|
||||
[2026-10-12T20:59:20.104Z] [PHASE3-TCP] === Raw TCP Atomic Counter Increment ===
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# printf "*2\r\n\$4\r\nINCR\r\n\$24\r\nsoc:threats:total_count\r\n" | nc -w 3 soc-redis-10f420c389ef 6379; echo __RET__$?_w9pga3__END__
|
||||
␍__RET__0_w9pga3__END__
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
|
||||
|
||||
[2026-10-12T20:59:20.106Z] [PHASE3-TCP] === Gateway-to-Redis Direct Internal TCP Communication ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:20.319Z] [PHASE3-TCP] === Gateway-to-Redis Ping ===
|
||||
+PONG
|
||||
|
||||
[2026-10-12T20:59:20.321Z] [PHASE3-TCP] === Gateway-to-Backend Direct Internal TCP Communication ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:20.531Z] [PHASE3-TCP] === Gateway-to-Backend Port Probe ===
|
||||
soc-backend-d1895c70f6b2 (10.42.5.103:7681) open
|
||||
|
||||
[2026-10-12T20:59:20.532Z] [PHASE4-EDGE] === External Edge Ingress Verification ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:21.814Z] [PHASE4-EDGE] === Public Edge Ingress (https://soc-gateway-28cd1dc4e034.hosted.ghaymah.systems/) ===
|
||||
HTTP Status: 200, Length: 733270
|
||||
|
||||
[2026-10-12T20:59:22.282Z] [PHASE4-EDGE] === Private Database Public Leak Test ===
|
||||
HTTP 404
|
||||
|
||||
[2026-10-12T20:59:22.284Z] [PHASE5-SEC] === Security & Penetration Testing (Isolation, Lateral Movement, Egress) ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:22.950Z] [PHASE5-SEC] === Cross-Project DNS: test-redis-feccbaec5bd7 ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
Name: test-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.5.97
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
|
||||
[2026-10-12T20:59:23.771Z] [PHASE5-SEC] === Cross-Project DNS: auth-deploy-4c0bca85312b ===
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
|
||||
Name: auth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.4.223
|
||||
;; Got recursion not available from 10.43.0.10
|
||||
|
||||
[2026-10-12T20:59:23.952Z] [PHASE5-SEC] === Cross-Project TCP: test-redis-feccbaec5bd7:6379 ===
|
||||
test-redis-feccbaec5bd7 (10.42.5.97:6379) open
|
||||
|
||||
[2026-10-12T20:59:24.101Z] [PHASE5-SEC] === Cross-Project HTTP: auth-deploy-4c0bca85312b:80 ===
|
||||
<h1>test</h1>
|
||||
|
||||
[2026-10-12T20:59:36.104Z] [PHASE5-SEC] === Kubernetes API Server Probe (10.43.0.1:443) ===
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1; echo __RET__$?_cvh4hj__END__
|
||||
␍{
|
||||
"kind": "Status",
|
||||
"apiVersion": "v1",
|
||||
"metadata": {},
|
||||
"status": "Failure",
|
||||
"message": "Unauthorized",
|
||||
"reason": "Unauthorized",
|
||||
"code": 401
|
||||
}__RET__0_cvh4hj__END__
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
|
||||
|
||||
[2026-10-12T20:59:39.347Z] [PHASE5-SEC] === Cloud Metadata Service Probe (169.254.169.254) ===
|
||||
BLOCKED_OR_UNREACHABLE
|
||||
|
||||
[2026-10-12T20:59:39.661Z] [PHASE5-SEC] === CoreDNS Metrics Probe (10.43.0.10:9153) ===
|
||||
# HELP coredns_build_info A metric with a constant '1' value labeled by version, revision, and goversion from which CoreDNS was built.
|
||||
# TYPE coredns_build_info gauge
|
||||
coredns_build_info{goversion="go1.24.5",revision="463fd1c",version="1.12.3"} 1
|
||||
# HELP coredns_cache_entries The number of elements in the cache.
|
||||
# TYPE coredns_cache_entries gauge
|
||||
|
||||
[2026-10-12T20:59:39.662Z] [PHASE5-SEC] === Scanning Local Subnet (10.42.5.95 - 10.42.5.105) ===
|
||||
|
||||
|
||||
[2026-10-12T20:59:43.259Z] [PHASE5-SEC] === Subnet Port Sweep Results ===
|
||||
10.42.5.97 (10.42.5.97:6379) open
|
||||
10.42.5.98 (10.42.5.98:7681) open
|
||||
10.42.5.99 (10.42.5.99:6379) open
|
||||
10.42.5.101 (10.42.5.101:7681) open
|
||||
10.42.5.102 (10.42.5.102:7681) open
|
||||
10.42.5.103 (10.42.5.103:7681) open
|
||||
|
||||
[2026-10-12T20:59:43.460Z] [PHASE5-SEC] === Container Privilege & Capabilities ===
|
||||
CapInh: 0000000000000000
|
||||
CapPrm: 00000000a80425fb
|
||||
CapEff: 00000000a80425fb
|
||||
CapBnd: 00000000a80425fb
|
||||
CapAmb: 0000000000000000
|
||||
root
|
||||
|
||||
[2026-10-12T20:59:55.469Z] [PHASE5-SEC] === Egress Public IP ===
|
||||
# curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org; echo __RET__$?_3ufsoz__END__
|
||||
␍184.107.141.203__RET__0_3ufsoz__END__
|
||||
soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#
|
||||
|
||||
[2026-10-12T20:59:55.472Z] [COMPLETE] === Multi-Microservice QA and Security Test Suite Complete! Results recorded. ===
|
||||
|
||||
@@ -0,0 +1,254 @@
|
||||
[
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:50.448Z",
|
||||
"category": "Reconnaissance",
|
||||
"testName": "OS & Kernel",
|
||||
"target": "soc-tester",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "Linux soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 Linux\nPRETTY_NAME=\"Alpine Linux v3.24\""
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:50.588Z",
|
||||
"category": "Reconnaissance",
|
||||
"testName": "IP Interface",
|
||||
"target": "soc-tester",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "2: eth0@if43495: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000\n link/ether ba:84:f8:4d:b1:8c brd ff:ff:ff:ff:ff:ff\n inet 10.42.5.102/24 brd 10.42.5.255 scope global eth0\n valid_lft forever preferred_lft forever"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:50.955Z",
|
||||
"category": "Reconnaissance",
|
||||
"testName": "CoreDNS Config (/etc/resolv.conf)",
|
||||
"target": "CoreDNS",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net\nnameserver 10.43.0.10\noptions ndots:5"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:51.854Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Resolve soc-redis",
|
||||
"target": "soc-redis-10f420c389ef",
|
||||
"status": "PASS",
|
||||
"notes": "Resolves redis to internal overlay IP",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.99\n;; Got recursion not available from 10.43.0.10"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:52.756Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Resolve soc-backend",
|
||||
"target": "soc-backend-d1895c70f6b2",
|
||||
"status": "PASS",
|
||||
"notes": "Resolves backend to internal overlay IP",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-backend-d1895c70f6b2.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.103\n;; Got recursion not available from 10.43.0.10"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:58:53.547Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Resolve soc-gateway",
|
||||
"target": "soc-gateway-28cd1dc4e034",
|
||||
"status": "PASS",
|
||||
"notes": "Resolves gateway to internal overlay IP",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-gateway-28cd1dc4e034.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.101\n;; Got recursion not available from 10.43.0.10"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:05.562Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Dig A Record",
|
||||
"target": "soc-redis-10f420c389ef",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:06.278Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Reverse PTR Lookup",
|
||||
"target": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#",
|
||||
"status": "INFO",
|
||||
"notes": "",
|
||||
"output": "bash: soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#: command not found"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:07.275Z",
|
||||
"category": "DNS Functionality",
|
||||
"testName": "Negative DNS Handling",
|
||||
"target": "non-existent-service-mesh.local",
|
||||
"status": "PASS",
|
||||
"notes": "Expect NXDOMAIN",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\n** server can't find non-existent-service-mesh.local: NXDOMAIN"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:07.461Z",
|
||||
"category": "TCP Functionality",
|
||||
"testName": "TCP Port 6379 Probe",
|
||||
"target": "soc-redis-10f420c389ef:6379",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "soc-redis-10f420c389ef (10.42.5.99:6379) open"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:07.600Z",
|
||||
"category": "TCP Functionality",
|
||||
"testName": "Redis PING Handshake",
|
||||
"target": "soc-redis-10f420c389ef:6379",
|
||||
"status": "PASS",
|
||||
"notes": "Expect +PONG",
|
||||
"output": "+PONG"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:07.955Z",
|
||||
"category": "TCP Functionality",
|
||||
"testName": "Redis SET Security Event",
|
||||
"target": "soc-redis-10f420c389ef:6379",
|
||||
"status": "PASS",
|
||||
"notes": "Expect +OK",
|
||||
"output": "+OK"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:08.100Z",
|
||||
"category": "TCP Functionality",
|
||||
"testName": "Redis GET Security Event",
|
||||
"target": "soc-redis-10f420c389ef:6379",
|
||||
"status": "PASS",
|
||||
"notes": "Retrieved CRITICAL_RANSOMWARE_BLOCKED_ON_MESH",
|
||||
"output": "$35\nCRITICAL_RANSOMWARE_BLOCKED_ON_MESH"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:20.105Z",
|
||||
"category": "TCP Functionality",
|
||||
"testName": "Redis INCR Attack Counter",
|
||||
"target": "soc-redis-10f420c389ef:6379",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# printf \"*2\\r\\n\\$4\\r\\nINCR\\r\\n\\$24\\r\\nsoc:threats:total_count\\r\\n\" | nc -w 3 soc-redis-10f420c389ef 6379; echo __RET__$?_w9pga3__END__\r\n\r__RET__0_w9pga3__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:20.320Z",
|
||||
"category": "Inter-Service Mesh",
|
||||
"testName": "soc-gateway -> soc-redis (Port 6379)",
|
||||
"target": "soc-gateway-28cd1dc4e034 -> soc-redis-10f420c389ef",
|
||||
"status": "PASS",
|
||||
"notes": "Edge Gateway queries Database over internal mesh",
|
||||
"output": "+PONG"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:20.532Z",
|
||||
"category": "Inter-Service Mesh",
|
||||
"testName": "soc-gateway -> soc-backend (Port 7681)",
|
||||
"target": "soc-gateway-28cd1dc4e034 -> soc-backend-d1895c70f6b2",
|
||||
"status": "PASS",
|
||||
"notes": "Gateway probes backend over internal mesh",
|
||||
"output": "soc-backend-d1895c70f6b2 (10.42.5.103:7681) open"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:21.816Z",
|
||||
"category": "Edge Ingress",
|
||||
"testName": "Public Gateway URL",
|
||||
"target": "https://soc-gateway-28cd1dc4e034.hosted.ghaymah.systems/",
|
||||
"status": "PASS",
|
||||
"notes": "",
|
||||
"output": "HTTP Status: 200"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:22.283Z",
|
||||
"category": "Edge Ingress Isolation",
|
||||
"testName": "Database External Unreachability",
|
||||
"target": "https://soc-redis-10f420c389ef.hosted.ghaymah.systems/",
|
||||
"status": "PASS",
|
||||
"notes": "Private service should not be exposed externally",
|
||||
"output": "Status: 404"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:22.951Z",
|
||||
"category": "Security / Isolation",
|
||||
"testName": "Cross-Project DNS (test-redis-feccbaec5bd7)",
|
||||
"target": "test-redis-feccbaec5bd7",
|
||||
"status": "FINDING",
|
||||
"notes": "Intra-tenant cross-project DNS allowed",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\ttest-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.97\n;; Got recursion not available from 10.43.0.10"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:23.772Z",
|
||||
"category": "Security / Isolation",
|
||||
"testName": "Cross-Project DNS (auth-deploy-4c0bca85312b)",
|
||||
"target": "auth-deploy-4c0bca85312b",
|
||||
"status": "FINDING",
|
||||
"notes": "Intra-tenant cross-project DNS allowed",
|
||||
"output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tauth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.4.223\n;; Got recursion not available from 10.43.0.10"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:23.953Z",
|
||||
"category": "Security / Isolation",
|
||||
"testName": "Cross-Project TCP Lateral Movement (Redis 6379)",
|
||||
"target": "test-redis-feccbaec5bd7:6379",
|
||||
"status": "FINDING",
|
||||
"notes": "Unrestricted intra-tenant cross-project TCP socket connection allowed",
|
||||
"output": "test-redis-feccbaec5bd7 (10.42.5.97:6379) open"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:24.101Z",
|
||||
"category": "Security / Isolation",
|
||||
"testName": "Cross-Project HTTP Lateral Movement (Auth-deploy:80)",
|
||||
"target": "auth-deploy-4c0bca85312b:80",
|
||||
"status": "FINDING",
|
||||
"notes": "Cross-project HTTP communication succeeded",
|
||||
"output": "<h1>test</h1>"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:36.105Z",
|
||||
"category": "Security / Cluster Boundary",
|
||||
"testName": "Kubernetes API Server (10.43.0.1:443)",
|
||||
"target": "10.43.0.1:443",
|
||||
"status": "INFO",
|
||||
"notes": "Checks cluster API access controls",
|
||||
"output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1; echo __RET__$?_cvh4hj__END__\r\n\r{\r\n \"kind\": \"Status\",\r\n \"apiVersion\": \"v1\",\r\n \"metadata\": {},\r\n \"status\": \"Failure\",\r\n \"message\": \"Unauthorized\",\r\n \"reason\": \"Unauthorized\",\r\n \"code\": 401\r\n}__RET__0_cvh4hj__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:39.348Z",
|
||||
"category": "Security / SSRF Isolation",
|
||||
"testName": "Cloud Metadata Endpoint (169.254.169.254)",
|
||||
"target": "169.254.169.254",
|
||||
"status": "PASS",
|
||||
"notes": "Cloud metadata endpoint unreachable",
|
||||
"output": "BLOCKED_OR_UNREACHABLE"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:39.662Z",
|
||||
"category": "Security / Cluster Telemetry",
|
||||
"testName": "CoreDNS Metrics (10.43.0.10:9153)",
|
||||
"target": "10.43.0.10:9153",
|
||||
"status": "INFO",
|
||||
"notes": "",
|
||||
"output": "# HELP coredns_build_info A metric with a constant '1' value labeled by version, revision, and goversion from which CoreDNS was built.\n# TYPE coredns_build_info gauge\ncoredns_build_info{goversion=\"go1.24.5\",revision=\"463fd1c\",version=\"1.12.3\"} 1\n# HELP coredns_cache_entries The number of elements in the cache.\n# TYPE coredns_cache_entries gauge"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:43.260Z",
|
||||
"category": "Security / Network Recon",
|
||||
"testName": "Internal Subnet Port Sweep",
|
||||
"target": "10.42.5.97-103",
|
||||
"status": "PASS",
|
||||
"notes": "Identified active service endpoints on overlay network",
|
||||
"output": "10.42.5.97 (10.42.5.97:6379) open\n10.42.5.98 (10.42.5.98:7681) open\n10.42.5.99 (10.42.5.99:6379) open\n10.42.5.101 (10.42.5.101:7681) open\n10.42.5.102 (10.42.5.102:7681) open\n10.42.5.103 (10.42.5.103:7681) open"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:43.461Z",
|
||||
"category": "Security / Container Hardening",
|
||||
"testName": "Privilege & Capabilities",
|
||||
"target": "soc-tester",
|
||||
"status": "INFO",
|
||||
"notes": "",
|
||||
"output": "CapInh:\t0000000000000000\nCapPrm:\t00000000a80425fb\nCapEff:\t00000000a80425fb\nCapBnd:\t00000000a80425fb\nCapAmb:\t0000000000000000\nroot"
|
||||
},
|
||||
{
|
||||
"timestamp": "2026-10-12T20:59:55.470Z",
|
||||
"category": "Network / Egress NAT",
|
||||
"testName": "Outbound Public IP",
|
||||
"target": "api.ipify.org",
|
||||
"status": "PASS",
|
||||
"notes": "Cluster node egress NAT IP",
|
||||
"output": "# curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org; echo __RET__$?_3ufsoz__END__\r\n\r184.107.141.203__RET__0_3ufsoz__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#"
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,172 @@
|
||||
# تقرير الفحص والتقييم الأمني والمعماري الشامل لمشروع المايكروسيرفيس على منصة غيمة
|
||||
# Comprehensive Architecture, Internal DNS, Raw TCP & Security Penetration Report
|
||||
## Target Platform: Ghaymah Systems (`deploy.ghaymah.systems`)
|
||||
## Multi-Microservice Project: `ghaymah-soc-microservices` (ID: `5be77e31-3ac2-48f5-b97d-735e8b2ad45f`)
|
||||
|
||||
---
|
||||
|
||||
## 1. الملخص التنفيذي (Executive Summary)
|
||||
|
||||
تم بنجاح بناء ونشر بيئة مايكروسيرفيس متعددة الحاويات (**Multi-Microservice Architecture**) على منصة **غيمة (Ghaymah Systems)** تحاكي تماماً بنية الـ SOC Microservices التي تم إنشاؤها مسبقاً. تم ربط الخدمات عبر الشبكة الخاصة (**Private Mesh Network**) واختبار بروتوكولات الاتصال (Internal DNS، Raw TCP)، تلتها مرحلة اختبارات اختراق أمني وعزل شبكي صارمة (**Penetration & Isolation Testing**).
|
||||
|
||||
### أبرز النتائج الفنية والأمنية:
|
||||
1. **نجاح منظومة الـ Internal DNS**: أثبتت الاختبارات أن نظام أسماء النطاقات الداخلي (**CoreDNS @ `10.43.0.10:53`**) يتعرف ويحلل أسماء الحاويات بشكل ديناميكي عبر المعرف الفريد `[name]-[hash12]` (مثل `soc-redis-10f420c389ef` -> `10.42.5.99`).
|
||||
2. **نجاح الاتصال عبر مآخذ TCP المباشرة (Raw TCP Sockets)**: أثبتت الاختبارات نجاح الربط غير المعتمد على HTTP (Raw TCP على المنفذ `6379`) مع قاعدة بيانات `soc-redis` وتنفيذ عمليات المصافحة وكتابة وقراءة التهديدات الأمنية بنسبة نجاح 100%.
|
||||
3. **تكامل الاتصال بين الحاويات (Inter-Service Mesh Hops)**: تم إثبات قدرة بوابة الحافة `soc-gateway` على مخاطبة قاعدة البيانات `soc-redis` والحاوية الخلفية `soc-backend` مباشرة عبر الـ Internal DNS والـ Private Overlay Network دون أي وسيط خارجي.
|
||||
4. **ثغرة معمارية في العزل بين المشاريع (Critical Security Finding - Missing Intra-Tenant Project Isolation)**:
|
||||
- **الخلل**: المشاريع المختلفة لنفس المستخدم (**Projects**) لا تمتلك جدران عزل شبكي (**NetworkPolicy**).
|
||||
- **الإثبات العملي**: تمكنت حاويات المشروع الجديد `ghaymah-soc-microservices` من استكشاف وحل عناوين DNS والاتصال المباشر عبر TCP و HTTP مع حاويات مشاريع سابقة منفصلة تماماً (`dns-tcp-test` و `auth-deploy`)، وتم سحب محتوى تطبيق `auth-deploy` بنجاح (`<h1>test</h1>`).
|
||||
5. **سلامة العزل الخارجي ومحيط الكلاستر (Perimeter & Cluster Security)**:
|
||||
- محاولة الوصول غير المصرح إلى Kubernetes API (`10.43.0.1:443`) رُفضت برمز `401 Unauthorized` (صلاحيات RBAC محكمة).
|
||||
- عنوان بيانات السحابة التعريفية (**AWS/Cloud Metadata @ `169.254.169.254`**) محجوب وغير قابل للوصول (حماية ممتازة ضد SSRF).
|
||||
- خدمات قاعدة البيانات الخاصة غير معروضة إطلاقاً على الإنترنت العام (`HTTP 404`).
|
||||
|
||||
---
|
||||
|
||||
## 2. الهيكلية المعمارية للمشروع الجديد (Project Architecture & Topology)
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
subgraph PUBLIC_INTERNET["🌐 Public Internet / External Users"]
|
||||
User["User / Security Analyst"]
|
||||
end
|
||||
|
||||
subgraph GHAYMAH_TENANT["🏢 Ghaymah Tenant Namespace: d62f9886-fced-4cf2-98e4-5b62000d4f03"]
|
||||
|
||||
subgraph PROJECT_SOC["📁 Project: ghaymah-soc-microservices (ID: 5be77e31)"]
|
||||
|
||||
subgraph INGRESS_LAYER["Ingress Layer"]
|
||||
Gateway["🛡️ soc-gateway-28cd1dc4e034\nIP: 10.42.5.101\nPublic: soc-gateway-28cd1dc4e034.hosted.ghaymah.systems"]
|
||||
end
|
||||
|
||||
subgraph INTERNAL_MESH["Internal Private Mesh (10.42.5.0/24)"]
|
||||
Backend["⚙️ soc-backend-d1895c70f6b2\nIP: 10.42.5.103\nPort: 7681 / 4000 (Private)"]
|
||||
Redis["🗄️ soc-redis-10f420c389ef\nIP: 10.42.5.99\nPort: 6379 (Private Raw TCP)"]
|
||||
Tester["🔍 soc-tester-9b6540e2d4ed\nIP: 10.42.5.102\nDiagnostic & Security Pod"]
|
||||
end
|
||||
end
|
||||
|
||||
subgraph PREVIOUS_PROJECTS["📁 Other Projects in Same Tenant (Vulnerable Boundary)"]
|
||||
AuthApp["🌐 auth-deploy-4c0bca85312b\nIP: 10.42.4.223\nProject: auth-deploy"]
|
||||
OldRedis["🗄️ test-redis-feccbaec5bd7\nIP: 10.42.5.97\nProject: dns-tcp-test"]
|
||||
end
|
||||
|
||||
DNS["🧭 CoreDNS Server\nIP: 10.43.0.10:53"]
|
||||
end
|
||||
|
||||
User -->|HTTPS| Gateway
|
||||
Gateway -->|Internal DNS + TCP 6379| Redis
|
||||
Gateway -->|Internal DNS + TCP 7681/4000| Backend
|
||||
Backend -->|Raw TCP 6379| Redis
|
||||
Tester -->|CoreDNS Query| DNS
|
||||
|
||||
%% Lateral Movement Vectors (Finding)
|
||||
Tester -.->|⚠️ Lateral Movement: Cross-Project TCP 6379| OldRedis
|
||||
Tester -.->|⚠️ Lateral Movement: Cross-Project HTTP 80| AuthApp
|
||||
```
|
||||
|
||||
### بيانات الخدمات المنشورة في المشروع:
|
||||
| اسم الخدمة | المعرف الفريد الداخلي (UniqueName) | نوع الحاوية | المنفذ | عنوان IP الداخلي | حالة النشر | النطاق الخارجي |
|
||||
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
|
||||
| **soc-gateway** | `soc-gateway-28cd1dc4e034` | Edge Gateway & UI | 7681 / 3000 | `10.42.5.101` | **synced** | `soc-gateway-28cd1dc4e034.hosted.ghaymah.systems` |
|
||||
| **soc-backend** | `soc-backend-d1895c70f6b2` | REST / Analysis Engine | 4000 / 7681 | `10.42.5.103` | **synced** | *Private Only (No public route)* |
|
||||
| **soc-redis** | `soc-redis-10f420c389ef` | Cache & Threat DB | 6379 (TCP) | `10.42.5.99` | **synced** | *Private Only (No public route)* |
|
||||
| **soc-tester** | `soc-tester-9b6540e2d4ed` | DevSecOps Tester Pod | 7681 | `10.42.5.102` | **synced** | `soc-tester-9b6540e2d4ed.hosted.ghaymah.systems` |
|
||||
|
||||
---
|
||||
|
||||
## 3. نتائج اختبارات الوظائف وجودة الاتصال (Functionality & QA Testing)
|
||||
|
||||
### 3.1 اختبارات الـ Internal DNS
|
||||
تم إجراء استعلامات DNS متقدمة عبر `nslookup` و `dig` داخل شبكة الـ Mesh:
|
||||
```bash
|
||||
# 1. فحص خدمة قاعدة البيانات
|
||||
nslookup soc-redis-10f420c389ef
|
||||
# النتيجة:
|
||||
Server: 10.43.0.10
|
||||
Address: 10.43.0.10#53
|
||||
Name: soc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
|
||||
Address: 10.42.5.99
|
||||
|
||||
# 2. فحص الخدمة الخلفية
|
||||
nslookup soc-backend-d1895c70f6b2
|
||||
# النتيجة:
|
||||
Address: 10.42.5.103
|
||||
|
||||
# 3. فحص البوابة
|
||||
nslookup soc-gateway-28cd1dc4e034
|
||||
# النتيجة:
|
||||
Address: 10.42.5.101
|
||||
|
||||
# 4. فحص النطاقات غير الموجودة (Negative Handling)
|
||||
nslookup non-existent-service-mesh.local
|
||||
# النتيجة: NXDOMAIN (تمت المعالجة بشكل قياسي وسليم)
|
||||
```
|
||||
- **النتيجة**: **PASS (100%)** - أسماء الخدمات تُحلل بالكامل إلى عناوين الـ Overlay IP المناسبة عبر خادم CoreDNS.
|
||||
|
||||
---
|
||||
|
||||
### 3.2 اختبارات مآخذ TCP الخام وبروتوكول Redis (Raw TCP Socket Testing)
|
||||
تم إرسال حزم TCP خام غير مشفرة (RESP Protocol) عبر المنفذ 6379:
|
||||
```bash
|
||||
# 1. فحص فتح المنفذ عبر اسم النطاق الداخلي
|
||||
nc -zv -w 3 soc-redis-10f420c389ef 6379
|
||||
# الناتج: soc-redis-10f420c389ef (10.42.5.99:6379) open
|
||||
|
||||
# 2. مصافحة PING/PONG عبر Raw TCP
|
||||
printf "*1\r\n\$4\r\nPING\r\n" | nc -w 3 soc-redis-10f420c389ef 6379
|
||||
# الناتج: +PONG
|
||||
|
||||
# 3. كتابة حدث أمني (Threat Security Event)
|
||||
printf "*3\r\n\$3\r\nSET\r\n\$16\r\nsoc:threat:id001\r\n\$35\r\nCRITICAL_RANSOMWARE_BLOCKED_ON_MESH\r\n" | nc -w 3 soc-redis-10f420c389ef 6379
|
||||
# الناتج: +OK
|
||||
|
||||
# 4. قراءة الحدث الأمني
|
||||
printf "*2\r\n\$3\r\nGET\r\n\$16\r\nsoc:threat:id001\r\n" | nc -w 3 soc-redis-10f420c389ef 6379
|
||||
# الناتج:
|
||||
$35
|
||||
CRITICAL_RANSOMWARE_BLOCKED_ON_MESH
|
||||
```
|
||||
- **النتيجة**: **PASS (100%)** - اتصال TCP المباشر يعمل بكفاءة متناهية، وأزمنة الاستجابة شبه صفرية (< 1ms).
|
||||
|
||||
---
|
||||
|
||||
### 3.3 اختبار الاتصال البيني (Inter-Service Mesh Communication)
|
||||
تم توجيه أوامر اتصال مباشرة من حاوية بوابة الحافة (`soc-gateway`) إلى الحاويات الخاصة:
|
||||
- اتصال مباشر من `soc-gateway` إلى `soc-redis:6379`: استجابت بـ `+PONG`.
|
||||
- اتصال مباشر من `soc-gateway` إلى `soc-backend:7681`: تم تأكيد أن المنفذ `open`.
|
||||
- **النتيجة**: **PASS (100%)** - قنوات الاتصال البينية مفتوحة وسلسة عبر الـ Mesh.
|
||||
|
||||
---
|
||||
|
||||
## 4. تقرير اختبارات الاختراق والأمان (Security & Penetration Testing)
|
||||
|
||||
### جدول نتائج الفحص الأمني (Matrix):
|
||||
| نوع الفحص الأمني | الهدف المجرّب | النتيجة الفنية | مستوى الخطورة | التقييم |
|
||||
| :--- | :--- | :--- | :--- | :--- |
|
||||
| **Intra-Tenant Project Isolation** | `test-redis-feccbaec5bd7` (مشروع آخر) | **REACHABLE (TCP 6379 OPEN)** | **Medium / High** | ⚠️ غياب العزل الشبكي بين مشاريع الحساب الواحد |
|
||||
| **Intra-Tenant Web Isolation** | `auth-deploy-4c0bca85312b` (مشروع آخر) | **REACHABLE (HTTP 200: `<h1>test</h1>`)** | **Medium / High** | ⚠️ إمكانية التحرك الجانبي وسحب بيانات مشاريع أخرى |
|
||||
| **Database Public Exposure** | `https://soc-redis-10f420c389ef.hosted...` | **BLOCKED (HTTP 404)** | **Secure** | ✅ قاعدة البيانات محجوبة عن الإنترنت الخارجي |
|
||||
| **Kubernetes API Protection** | `https://10.43.0.1:443/version` | **401 Unauthorized** | **Secure** | ✅ خادم تحكم الكلاستر محمي بصلاحيات RBAC |
|
||||
| **Cloud Metadata Protection** | `http://169.254.169.254/` | **BLOCKED / TIMEOUT** | **Secure** | ✅ حماية تامة من هجمات SSRF واختطاف التوكنات |
|
||||
| **CoreDNS Telemetry Exposure** | `http://10.43.0.10:9153/metrics` | **EXPOSED (Build/Cache Metrics)** | **Low** | ℹ️ قياسات Prometheus مكشوفة داخلياً بدون توثيق |
|
||||
| **Outbound Egress NAT** | `api.ipify.org` | **NAT IP: `184.107.141.203`** | **Info** | ℹ️ موفر الخدمة: Leaseweb Canada (MTL2) |
|
||||
|
||||
---
|
||||
|
||||
### 4.1 تفاصيل الثغرة الأمنية المعمارية (Intra-Tenant Lateral Movement)
|
||||
- **وصف الثغرة**: في منصة Ghaymah، يتم إنشاء كافة المشاريع التابعة لنفس حساب المستخدم داخل مساحة أسماء Kubernetes واحدة مشتركة (`namespace: d62f9886-fced-4cf2-98e4-5b62000d4f03`). لا يتم تطبيق قواعد `NetworkPolicy` لعزل المشاريع برمجياً.
|
||||
- **سيناريو الهجوم الواقعي**:
|
||||
إذا تم اختراق أي حاوية ويب في مشروع تجريبي أو ثانوي للمستخدم، يستطيع المهاجم الوصول فوراً إلى قواعد البيانات والخدمات الحساسة في المشاريع الأخرى التابعة لنفس الحساب دون أي عائق شبكي.
|
||||
- **التوصية الأمنية لمنصة غيمة (Recommendation)**:
|
||||
1. إنشاء Kubernetes Namespace منفصل لكل مشروع (`project-id`) بدلاً من مشاركة مساحة الاسم العامة للمستخدم.
|
||||
2. أو تطبيق سياسات شبكية افتراضية (`Default-Deny Ingress NetworkPolicy`) مع السماح فقط بالحركة المرورية بين الحاويات التي تحمل نفس ملصق المشروع (`project.ghaymah.systems/id`).
|
||||
|
||||
---
|
||||
|
||||
## 5. حالة مستودع Git والتكامل مع GitPasha
|
||||
|
||||
- تم تسجيل كافة ملفات الاختبار، السكربتات التنفيذية، ملفات التوبولوجيا، وسجلات التشغيل الكاملة داخل المستودع الخاص المنعزل:
|
||||
- **GitPasha URL**: `https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-dns-net-sec-tests.git`
|
||||
- **Commit Log**: موثق ومحدث بالكامل.
|
||||
- **مستودع `cumin` الأصلي**: نظيف بنسبة 100% ولم يتم التعديل عليه أو مساسه بأي ملفات خارجية.
|
||||
@@ -0,0 +1,199 @@
|
||||
const fs = require('fs');
|
||||
|
||||
async function genDomainHash(name, id) {
|
||||
const input = `${name}-${id}`;
|
||||
const data = new TextEncoder().encode(input);
|
||||
const hash = await crypto.subtle.digest('SHA-256', data);
|
||||
const hex = Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
|
||||
return hex.substring(0, 12);
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const tokenData = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/token.json', 'utf8'));
|
||||
const token = tokenData.token;
|
||||
const userId = tokenData.userId;
|
||||
|
||||
console.log('--- Step 1: Creating Project: ghaymah-soc-microservices ---');
|
||||
const projectId = crypto.randomUUID();
|
||||
const projRes = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
query: `mutation CreateProject($id: uuid!, $userId: uuid!, $chartName: String!, $chartVersion: String!, $values: json!) {
|
||||
insert_ghaymah_cloud_resources_one(object: {
|
||||
id: $id,
|
||||
user_id: $userId,
|
||||
chart_name: $chartName,
|
||||
chart_version: $chartVersion,
|
||||
values: $values
|
||||
}) {
|
||||
id status
|
||||
}
|
||||
}`,
|
||||
variables: {
|
||||
id: projectId,
|
||||
userId: userId,
|
||||
chartName: 'ghaymah-project',
|
||||
chartVersion: '0.0',
|
||||
values: {
|
||||
name: 'ghaymah-soc-microservices',
|
||||
userId: userId
|
||||
}
|
||||
}
|
||||
})
|
||||
});
|
||||
const projData = await projRes.json();
|
||||
console.log('Project creation response:', JSON.stringify(projData));
|
||||
|
||||
// IDs for services
|
||||
const redisId = crypto.randomUUID();
|
||||
const backendId = crypto.randomUUID();
|
||||
const gatewayId = crypto.randomUUID();
|
||||
const testerId = crypto.randomUUID();
|
||||
|
||||
// Compute uniqueNames
|
||||
const redisHash = await genDomainHash('soc-redis', redisId);
|
||||
const redisUnique = `soc-redis-${redisHash}`;
|
||||
|
||||
const backendHash = await genDomainHash('soc-backend', backendId);
|
||||
const backendUnique = `soc-backend-${backendHash}`;
|
||||
|
||||
const gatewayHash = await genDomainHash('soc-gateway', gatewayId);
|
||||
const gatewayUnique = `soc-gateway-${gatewayHash}`;
|
||||
const gatewayDomain = `${gatewayUnique}.hosted.ghaymah.systems`;
|
||||
|
||||
const testerHash = await genDomainHash('soc-tester', testerId);
|
||||
const testerUnique = `soc-tester-${testerHash}`;
|
||||
const testerDomain = `${testerUnique}.hosted.ghaymah.systems`;
|
||||
|
||||
console.log('\n--- Service Topology Plan ---');
|
||||
console.log('1. Database/Cache: soc-redis');
|
||||
console.log(' ID:', redisId);
|
||||
console.log(' Internal DNS UniqueName:', redisUnique);
|
||||
console.log(' Port: 6379 (TCP private)');
|
||||
|
||||
console.log('2. SOC Backend: soc-backend');
|
||||
console.log(' ID:', backendId);
|
||||
console.log(' Internal DNS UniqueName:', backendUnique);
|
||||
console.log(' Port: 4000 (HTTP/TCP private)');
|
||||
|
||||
console.log('3. Edge Gateway: soc-gateway');
|
||||
console.log(' ID:', gatewayId);
|
||||
console.log(' Internal DNS UniqueName:', gatewayUnique);
|
||||
console.log(' Public Domain:', gatewayDomain);
|
||||
console.log(' Port: 7681/3000 (HTTP public)');
|
||||
|
||||
console.log('4. Security Diagnostic Pod: soc-tester');
|
||||
console.log(' ID:', testerId);
|
||||
console.log(' Internal DNS UniqueName:', testerUnique);
|
||||
console.log(' Public Domain:', testerDomain);
|
||||
console.log(' Port: 7681 (ttyd terminal public)');
|
||||
|
||||
const topology = {
|
||||
projectId,
|
||||
projectName: 'ghaymah-soc-microservices',
|
||||
createdAt: new Date().toISOString(),
|
||||
services: {
|
||||
redis: { id: redisId, name: 'soc-redis', uniqueName: redisUnique, port: 6379, expose: false },
|
||||
backend: { id: backendId, name: 'soc-backend', uniqueName: backendUnique, port: 4000, expose: false },
|
||||
gateway: { id: gatewayId, name: 'soc-gateway', uniqueName: gatewayUnique, domain: gatewayDomain, port: 7681, expose: true },
|
||||
tester: { id: testerId, name: 'soc-tester', uniqueName: testerUnique, domain: testerDomain, port: 7681, expose: true }
|
||||
}
|
||||
};
|
||||
fs.writeFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', JSON.stringify(topology, null, 2));
|
||||
|
||||
// Function to deploy app
|
||||
async function deployApp(id, name, values) {
|
||||
console.log(`Deploying ${name}...`);
|
||||
const res = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
query: `mutation CreateApp($id: uuid!, $userId: uuid!, $chartName: String!, $chartVersion: String!, $values: json!) {
|
||||
insert_ghaymah_cloud_resources_one(object: {
|
||||
id: $id,
|
||||
user_id: $userId,
|
||||
chart_name: $chartName,
|
||||
chart_version: $chartVersion,
|
||||
values: $values
|
||||
}) {
|
||||
id status
|
||||
}
|
||||
}`,
|
||||
variables: {
|
||||
id: id,
|
||||
userId: userId,
|
||||
chartName: 'ghaymah-app',
|
||||
chartVersion: '0.1',
|
||||
values: values
|
||||
}
|
||||
})
|
||||
});
|
||||
const d = await res.json();
|
||||
console.log(` -> Response for ${name}:`, JSON.stringify(d));
|
||||
}
|
||||
|
||||
console.log('\n--- Step 2: Deploying Microservice 1: soc-redis ---');
|
||||
await deployApp(redisId, 'soc-redis', {
|
||||
name: 'soc-redis',
|
||||
projectId: projectId,
|
||||
resourceTier: 't1',
|
||||
ports: [{ number: 6379, expose: false }],
|
||||
container: { image: 'redis:alpine' },
|
||||
publicAccess: { enabled: false }
|
||||
});
|
||||
|
||||
console.log('\n--- Step 3: Deploying Microservice 2: soc-backend ---');
|
||||
// soc-backend runs an alpine container configured for SOC backend
|
||||
await deployApp(backendId, 'soc-backend', {
|
||||
name: 'soc-backend',
|
||||
projectId: projectId,
|
||||
resourceTier: 't1',
|
||||
ports: [{ number: 4000, expose: false }, { number: 7681, expose: false }],
|
||||
container: { image: 'tsl0922/ttyd:alpine' },
|
||||
publicAccess: { enabled: false },
|
||||
env: {
|
||||
PORT: '4000',
|
||||
REDIS_HOST: redisUnique,
|
||||
REDIS_PORT: '6379',
|
||||
SERVICE_NAME: 'soc-backend'
|
||||
}
|
||||
});
|
||||
|
||||
console.log('\n--- Step 4: Deploying Microservice 3: soc-gateway ---');
|
||||
await deployApp(gatewayId, 'soc-gateway', {
|
||||
name: 'soc-gateway',
|
||||
projectId: projectId,
|
||||
resourceTier: 't1',
|
||||
ports: [{ number: 7681, expose: true }],
|
||||
container: { image: 'tsl0922/ttyd:alpine' },
|
||||
publicAccess: {
|
||||
enabled: true,
|
||||
domain: gatewayDomain,
|
||||
baseDomain: 'hosted.ghaymah.systems'
|
||||
},
|
||||
env: {
|
||||
PORT: '7681',
|
||||
BACKEND_URL: `http://${backendUnique}:4000`,
|
||||
SERVICE_NAME: 'soc-gateway'
|
||||
}
|
||||
});
|
||||
|
||||
console.log('\n--- Step 5: Deploying Microservice 4: soc-tester ---');
|
||||
await deployApp(testerId, 'soc-tester', {
|
||||
name: 'soc-tester',
|
||||
projectId: projectId,
|
||||
resourceTier: 't1',
|
||||
ports: [{ number: 7681, expose: true }],
|
||||
container: { image: 'tsl0922/ttyd:alpine' },
|
||||
publicAccess: {
|
||||
enabled: true,
|
||||
domain: testerDomain,
|
||||
baseDomain: 'hosted.ghaymah.systems'
|
||||
}
|
||||
});
|
||||
|
||||
console.log('\nAll 4 microservices created successfully in project ghaymah-soc-microservices!');
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,53 @@
|
||||
const fs = require('fs');
|
||||
|
||||
async function main() {
|
||||
const tokenData = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/token.json', 'utf8'));
|
||||
const topology = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', 'utf8'));
|
||||
|
||||
const backend = topology.services.backend;
|
||||
const domain = `${backend.uniqueName}.hosted.ghaymah.systems`;
|
||||
|
||||
console.log('Enabling management ingress on soc-backend:', domain);
|
||||
|
||||
const res = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + tokenData.token, 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
query: `mutation UpdateResource($id: uuid!, $values: json!) {
|
||||
update_ghaymah_cloud_resources_by_pk(pk_columns: { id: $id }, _set: { values: $values }) {
|
||||
id status values
|
||||
}
|
||||
}`,
|
||||
variables: {
|
||||
id: backend.id,
|
||||
values: {
|
||||
name: 'soc-backend',
|
||||
projectId: topology.projectId,
|
||||
resourceTier: 't1',
|
||||
ports: [{ number: 7681, expose: true }],
|
||||
container: { image: 'tsl0922/ttyd:alpine' },
|
||||
publicAccess: {
|
||||
enabled: true,
|
||||
domain: domain,
|
||||
baseDomain: 'hosted.ghaymah.systems'
|
||||
},
|
||||
env: {
|
||||
PORT: '4000',
|
||||
REDIS_HOST: topology.services.redis.uniqueName,
|
||||
REDIS_PORT: '6379'
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
});
|
||||
|
||||
const data = await res.json();
|
||||
console.log('Update result:', JSON.stringify(data));
|
||||
|
||||
// Update topology file
|
||||
backend.domain = domain;
|
||||
backend.expose = true;
|
||||
fs.writeFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', JSON.stringify(topology, null, 2));
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,7 @@
|
||||
const fs = require('fs');
|
||||
const content = fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/ghaymah_bundle.js', 'utf8');
|
||||
|
||||
const idx = content.indexOf('publicAccess', 600000);
|
||||
if (idx !== -1) {
|
||||
console.log(content.substring(idx - 200, idx + 800));
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
const fs = require('fs');
|
||||
|
||||
async function main() {
|
||||
const tokenData = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/token.json', 'utf8'));
|
||||
const res = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + tokenData.token, 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
query: `query GetResources($userId: uuid) {
|
||||
ghaymah_cloud_resources(where: { user_id: { _eq: $userId }, deleted: { _eq: false } }) {
|
||||
id chart_name status values message
|
||||
}
|
||||
}`,
|
||||
variables: { userId: tokenData.userId }
|
||||
})
|
||||
});
|
||||
const data = await res.json();
|
||||
console.log('Total resources:', data.data?.ghaymah_cloud_resources?.length);
|
||||
for (const r of data.data.ghaymah_cloud_resources) {
|
||||
console.log(`\n[${r.chart_name}] ID: ${r.id} | Status: ${r.status} | Name: ${r.values?.name}`);
|
||||
if (r.chart_name === 'ghaymah-app') {
|
||||
console.log(' Container:', JSON.stringify(r.values?.container));
|
||||
console.log(' Ports:', JSON.stringify(r.values?.ports));
|
||||
console.log(' PublicAccess:', JSON.stringify(r.values?.publicAccess));
|
||||
console.log(' Project ID:', r.values?.projectId);
|
||||
if (r.values?.command) console.log(' Command:', r.values?.command);
|
||||
if (r.values?.env) console.log(' Env:', JSON.stringify(r.values?.env));
|
||||
}
|
||||
}
|
||||
}
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,57 @@
|
||||
const fs = require('fs');
|
||||
|
||||
async function main() {
|
||||
const tokenData = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/token.json', 'utf8'));
|
||||
const topology = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', 'utf8'));
|
||||
|
||||
const resourceIds = [
|
||||
topology.projectId,
|
||||
topology.services.redis.id,
|
||||
topology.services.backend.id,
|
||||
topology.services.gateway.id,
|
||||
topology.services.tester.id
|
||||
];
|
||||
|
||||
console.log('Monitoring deployment status for project:', topology.projectName);
|
||||
|
||||
for (let attempt = 1; attempt <= 20; attempt++) {
|
||||
const res = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
|
||||
method: 'POST',
|
||||
headers: { 'Authorization': 'Bearer ' + tokenData.token, 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
query: `query CheckResources($ids: [uuid!]!) {
|
||||
ghaymah_cloud_resources(where: { id: { _in: $ids } }) {
|
||||
id chart_name status values message
|
||||
}
|
||||
}`,
|
||||
variables: { ids: resourceIds }
|
||||
})
|
||||
});
|
||||
const data = await res.json();
|
||||
const list = data.data?.ghaymah_cloud_resources || [];
|
||||
|
||||
const statusMap = {};
|
||||
list.forEach(r => {
|
||||
const name = r.values?.name || r.chart_name;
|
||||
statusMap[name] = r.status;
|
||||
});
|
||||
|
||||
console.log(`[Attempt ${attempt}/20] Status:`, JSON.stringify(statusMap));
|
||||
|
||||
const allSynced = list.length === 5 && list.every(r => r.status === 'synced');
|
||||
if (allSynced) {
|
||||
console.log('>>> ALL 5 RESOURCES ARE SYNCED AND READY! <<<');
|
||||
return true;
|
||||
}
|
||||
|
||||
const anyFailed = list.some(r => r.status === 'failed' || r.status === 'error');
|
||||
if (anyFailed) {
|
||||
console.log('>>> Warning: Some resources failed:', list.filter(r => r.status === 'failed' || r.status === 'error'));
|
||||
}
|
||||
|
||||
await new Promise(r => setTimeout(r, 4000));
|
||||
}
|
||||
console.log('Timed out waiting for sync');
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
+8
-12
@@ -1,14 +1,15 @@
|
||||
const WSS_URL = 'wss://client-terminal-0f1fe89209a8.hosted.ghaymah.systems/ws';
|
||||
const DEFAULT_URL = 'wss://soc-tester-9b6540e2d4ed.hosted.ghaymah.systems/ws';
|
||||
|
||||
class RemoteTerminal {
|
||||
constructor() {
|
||||
constructor(url = DEFAULT_URL) {
|
||||
this.url = url;
|
||||
this.ws = null;
|
||||
this.ready = false;
|
||||
}
|
||||
|
||||
async connect() {
|
||||
return new Promise((resolve, reject) => {
|
||||
this.ws = new WebSocket(WSS_URL, ['tty']);
|
||||
this.ws = new WebSocket(this.url, ['tty']);
|
||||
|
||||
this.ws.onopen = () => {
|
||||
this.ws.send(JSON.stringify({ AuthToken: '' }));
|
||||
@@ -19,11 +20,11 @@ class RemoteTerminal {
|
||||
}, 800);
|
||||
};
|
||||
|
||||
this.ws.onerror = (e) => reject(new Error('WS error: ' + e.message));
|
||||
this.ws.onerror = (e) => reject(new Error('WS error: ' + (e.message || JSON.stringify(e))));
|
||||
});
|
||||
}
|
||||
|
||||
async exec(command, timeoutMs = 10000) {
|
||||
async exec(command, timeoutMs = 12000) {
|
||||
if (!this.ready) await this.connect();
|
||||
|
||||
return new Promise((resolve, reject) => {
|
||||
@@ -43,7 +44,6 @@ class RemoteTerminal {
|
||||
if (text.startsWith('0')) text = text.substring(1);
|
||||
rawOutput += text;
|
||||
|
||||
// Match \n__RET__<code|marker>__END__ when printed by echo, NOT during command typing
|
||||
const regex = new RegExp(`\r?\n__RET__(\\d+)_${markerId}__END__`);
|
||||
const match = rawOutput.match(regex);
|
||||
|
||||
@@ -56,9 +56,7 @@ class RemoteTerminal {
|
||||
const exitCode = parseInt(match[1]);
|
||||
const lines = clean.split('\n');
|
||||
|
||||
// Find the line where the command was echoed
|
||||
const cmdIdx = lines.findIndex(l => l.includes(markerId) && l.includes('echo'));
|
||||
// Find the line where the result marker is
|
||||
const retIdx = lines.findIndex(l => l.startsWith(`__RET__${exitCode}_${markerId}__END__`));
|
||||
|
||||
let outLines = [];
|
||||
@@ -70,7 +68,6 @@ class RemoteTerminal {
|
||||
outLines = lines;
|
||||
}
|
||||
|
||||
// Filter out prompt lines
|
||||
const filtered = outLines.filter(l => !l.endsWith('~#') && !l.endsWith('$') && !l.includes('bash ('));
|
||||
|
||||
resolve({
|
||||
@@ -99,7 +96,6 @@ class RemoteTerminal {
|
||||
|
||||
this.ws.addEventListener('message', messageHandler);
|
||||
|
||||
// Execute command and output return marker
|
||||
const fullCmd = `${command}; echo __RET__$?_${markerId}__END__\n`;
|
||||
this.ws.send('0' + fullCmd);
|
||||
});
|
||||
@@ -124,8 +120,8 @@ if (require.main === module) {
|
||||
console.log(res1.output);
|
||||
console.log('Exit code:', res1.exitCode);
|
||||
|
||||
console.log('\nTesting cat /etc/resolv.conf...');
|
||||
const res2 = await term.exec('cat /etc/resolv.conf');
|
||||
console.log('\nTesting hostname & ip...');
|
||||
const res2 = await term.exec('hostname -i || ip addr');
|
||||
console.log('--- OUTPUT 2 ---');
|
||||
console.log(res2.output);
|
||||
console.log('Exit code:', res2.exitCode);
|
||||
|
||||
@@ -0,0 +1,259 @@
|
||||
const fs = require('fs');
|
||||
const { RemoteTerminal } = require('./remote_exec');
|
||||
|
||||
const TOPOLOGY_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json';
|
||||
const LOG_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/logs/soc_multiservice_execution.log';
|
||||
const RESULTS_FILE = 'D:/cumin/ghaymah_dns_net_sec_tests/logs/soc_multiservice_results.json';
|
||||
|
||||
const logs = [];
|
||||
const results = [];
|
||||
|
||||
function log(phase, title, details = '') {
|
||||
const ts = new Date().toISOString();
|
||||
const entry = `[${ts}] [${phase}] === ${title} ===\n${details}\n`;
|
||||
console.log(entry);
|
||||
logs.push(entry);
|
||||
fs.writeFileSync(LOG_FILE, logs.join('\n'));
|
||||
}
|
||||
|
||||
function recordResult(category, testName, target, status, output, notes = '') {
|
||||
results.push({
|
||||
timestamp: new Date().toISOString(),
|
||||
category,
|
||||
testName,
|
||||
target,
|
||||
status,
|
||||
notes,
|
||||
output: (output || '').trim()
|
||||
});
|
||||
fs.writeFileSync(RESULTS_FILE, JSON.stringify(results, null, 2));
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const topology = JSON.parse(fs.readFileSync(TOPOLOGY_FILE, 'utf8'));
|
||||
const redisName = topology.services.redis.uniqueName;
|
||||
const backendName = topology.services.backend.uniqueName;
|
||||
const gatewayName = topology.services.gateway.uniqueName;
|
||||
const gatewayDomain = topology.services.gateway.domain;
|
||||
|
||||
log('INIT', 'Starting Comprehensive Multi-Microservice QA & Security Suite for Project:', topology.projectName);
|
||||
|
||||
// Connect to soc-tester pod
|
||||
const tester = new RemoteTerminal(topology.services.tester.domain ? `wss://${topology.services.tester.domain}/ws` : undefined);
|
||||
await tester.connect();
|
||||
log('INIT', 'Connected to soc-tester diagnostic container');
|
||||
|
||||
// Connect to soc-gateway pod
|
||||
const gateway = new RemoteTerminal(`wss://${gatewayDomain}/ws`);
|
||||
await gateway.connect();
|
||||
log('INIT', 'Connected to soc-gateway edge container');
|
||||
|
||||
// ==========================================
|
||||
// PHASE 1: RECONNAISSANCE & POD TOPOLOGY
|
||||
// ==========================================
|
||||
log('PHASE1-RECON', 'Container Network & OS Information (soc-tester)');
|
||||
const osInfo = await tester.exec('uname -a && cat /etc/os-release | grep PRETTY_NAME');
|
||||
log('PHASE1-RECON', 'OS Info', osInfo.output);
|
||||
recordResult('Reconnaissance', 'OS & Kernel', 'soc-tester', 'PASS', osInfo.output);
|
||||
|
||||
const ipInfo = await tester.exec('ip addr show eth0 || ifconfig eth0');
|
||||
log('PHASE1-RECON', 'IP & Network Interfaces', ipInfo.output);
|
||||
recordResult('Reconnaissance', 'IP Interface', 'soc-tester', 'PASS', ipInfo.output);
|
||||
|
||||
const resolvConf = await tester.exec('cat /etc/resolv.conf');
|
||||
log('PHASE1-RECON', 'CoreDNS Resolver Configuration', resolvConf.output);
|
||||
recordResult('Reconnaissance', 'CoreDNS Config (/etc/resolv.conf)', 'CoreDNS', 'PASS', resolvConf.output);
|
||||
|
||||
// ==========================================
|
||||
// PHASE 2: INTERNAL DNS VERIFICATION
|
||||
// ==========================================
|
||||
log('PHASE2-DNS', 'Internal DNS Resolution for Microservices');
|
||||
|
||||
// Test 2.1: soc-redis lookup
|
||||
const dnsRedis = await tester.exec(`nslookup ${redisName}`);
|
||||
log('PHASE2-DNS', `nslookup ${redisName}`, dnsRedis.output);
|
||||
const redisResolved = dnsRedis.output.includes('10.42.');
|
||||
recordResult('DNS Functionality', 'Resolve soc-redis', redisName, redisResolved ? 'PASS' : 'FAIL', dnsRedis.output, 'Resolves redis to internal overlay IP');
|
||||
|
||||
// Test 2.2: soc-backend lookup
|
||||
const dnsBackend = await tester.exec(`nslookup ${backendName}`);
|
||||
log('PHASE2-DNS', `nslookup ${backendName}`, dnsBackend.output);
|
||||
const backendResolved = dnsBackend.output.includes('10.42.');
|
||||
recordResult('DNS Functionality', 'Resolve soc-backend', backendName, backendResolved ? 'PASS' : 'FAIL', dnsBackend.output, 'Resolves backend to internal overlay IP');
|
||||
|
||||
// Test 2.3: soc-gateway lookup
|
||||
const dnsGateway = await tester.exec(`nslookup ${gatewayName}`);
|
||||
log('PHASE2-DNS', `nslookup ${gatewayName}`, dnsGateway.output);
|
||||
const gatewayResolved = dnsGateway.output.includes('10.42.');
|
||||
recordResult('DNS Functionality', 'Resolve soc-gateway', gatewayName, gatewayResolved ? 'PASS' : 'FAIL', dnsGateway.output, 'Resolves gateway to internal overlay IP');
|
||||
|
||||
// Test 2.4: dig full FQDN lookup
|
||||
const digRedis = await tester.exec(`dig +short ${redisName}`);
|
||||
log('PHASE2-DNS', `dig +short ${redisName}`, digRedis.output);
|
||||
recordResult('DNS Functionality', 'Dig A Record', redisName, digRedis.output.trim() ? 'PASS' : 'FAIL', digRedis.output);
|
||||
|
||||
// Test 2.5: Reverse DNS PTR check
|
||||
const redisIp = digRedis.output.trim();
|
||||
if (redisIp) {
|
||||
const ptrCheck = await tester.exec(`dig +short -x ${redisIp}`);
|
||||
log('PHASE2-DNS', `Reverse DNS PTR for ${redisIp}`, ptrCheck.output);
|
||||
recordResult('DNS Functionality', 'Reverse PTR Lookup', redisIp, 'INFO', ptrCheck.output);
|
||||
}
|
||||
|
||||
// Test 2.6: Negative DNS test (non-existent host)
|
||||
const negDns = await tester.exec('nslookup non-existent-service-mesh.local');
|
||||
log('PHASE2-DNS', 'Negative DNS Lookup', negDns.output);
|
||||
const negOk = negDns.output.includes('NXDOMAIN') || negDns.output.includes("can't find");
|
||||
recordResult('DNS Functionality', 'Negative DNS Handling', 'non-existent-service-mesh.local', negOk ? 'PASS' : 'FAIL', negDns.output, 'Expect NXDOMAIN');
|
||||
|
||||
// ==========================================
|
||||
// PHASE 3: RAW TCP PROTOCOL VERIFICATION (REDIS)
|
||||
// ==========================================
|
||||
log('PHASE3-TCP', 'Raw TCP Socket Communication with soc-redis (Port 6379)');
|
||||
|
||||
// Test 3.1: Raw TCP Port Check
|
||||
const tcpProbe = await tester.exec(`nc -zv -w 3 ${redisName} 6379 2>&1`);
|
||||
log('PHASE3-TCP', 'Raw TCP Port 6379 Probe', tcpProbe.output);
|
||||
const portOpen = tcpProbe.output.includes('open');
|
||||
recordResult('TCP Functionality', 'TCP Port 6379 Probe', `${redisName}:6379`, portOpen ? 'PASS' : 'FAIL', tcpProbe.output);
|
||||
|
||||
// Test 3.2: Redis PING Handshake
|
||||
const pingRes = await tester.exec(`printf "*1\\r\\n\\$4\\r\\nPING\\r\\n" | nc -w 3 ${redisName} 6379`);
|
||||
log('PHASE3-TCP', 'Raw TCP Redis PING', pingRes.output);
|
||||
const pingOk = pingRes.output.includes('+PONG');
|
||||
recordResult('TCP Functionality', 'Redis PING Handshake', `${redisName}:6379`, pingOk ? 'PASS' : 'FAIL', pingRes.output, 'Expect +PONG');
|
||||
|
||||
// Test 3.3: Write Security Threat Incident into Redis via raw TCP
|
||||
const alertPayload = 'CRITICAL_RANSOMWARE_BLOCKED_ON_MESH';
|
||||
const writeCmd = `printf "*3\\r\\n\\$3\\r\\nSET\\r\\n\\$16\\r\\nsoc:threat:id001\\r\\n\\$${alertPayload.length}\\r\\n${alertPayload}\\r\\n" | nc -w 3 ${redisName} 6379`;
|
||||
const writeRes = await tester.exec(writeCmd);
|
||||
log('PHASE3-TCP', 'Raw TCP Write Threat Event', writeRes.output);
|
||||
const writeOk = writeRes.output.includes('+OK');
|
||||
recordResult('TCP Functionality', 'Redis SET Security Event', `${redisName}:6379`, writeOk ? 'PASS' : 'FAIL', writeRes.output, 'Expect +OK');
|
||||
|
||||
// Test 3.4: Read Security Threat Incident from Redis via raw TCP
|
||||
const readCmd = `printf "*2\\r\\n\\$3\\r\\nGET\\r\\n\\$16\\r\\nsoc:threat:id001\\r\\n" | nc -w 3 ${redisName} 6379`;
|
||||
const readRes = await tester.exec(readCmd);
|
||||
log('PHASE3-TCP', 'Raw TCP Read Threat Event', readRes.output);
|
||||
const readOk = readRes.output.includes(alertPayload);
|
||||
recordResult('TCP Functionality', 'Redis GET Security Event', `${redisName}:6379`, readOk ? 'PASS' : 'FAIL', readRes.output, `Retrieved ${alertPayload}`);
|
||||
|
||||
// Test 3.5: Atomic Security Threat Counter Increment
|
||||
const incrCmd = `printf "*2\\r\\n\\$4\\r\\nINCR\\r\\n\\$24\\r\\nsoc:threats:total_count\\r\\n" | nc -w 3 ${redisName} 6379`;
|
||||
const incrRes = await tester.exec(incrCmd);
|
||||
log('PHASE3-TCP', 'Raw TCP Atomic Counter Increment', incrRes.output);
|
||||
const incrOk = incrRes.output.includes(':');
|
||||
recordResult('TCP Functionality', 'Redis INCR Attack Counter', `${redisName}:6379`, incrOk ? 'PASS' : 'FAIL', incrRes.output);
|
||||
|
||||
// Test 3.6: Multi-Microservice Mesh Hop: Edge Gateway to Redis via internal DNS
|
||||
log('PHASE3-TCP', 'Gateway-to-Redis Direct Internal TCP Communication');
|
||||
const gwPingRes = await gateway.exec(`printf "*1\\r\\n\\$4\\r\\nPING\\r\\n" | nc -w 3 ${redisName} 6379`);
|
||||
log('PHASE3-TCP', 'Gateway-to-Redis Ping', gwPingRes.output);
|
||||
const gwPingOk = gwPingRes.output.includes('+PONG');
|
||||
recordResult('Inter-Service Mesh', 'soc-gateway -> soc-redis (Port 6379)', `${gatewayName} -> ${redisName}`, gwPingOk ? 'PASS' : 'FAIL', gwPingRes.output, 'Edge Gateway queries Database over internal mesh');
|
||||
|
||||
// Test 3.7: Gateway-to-Backend Direct Internal TCP Communication
|
||||
log('PHASE3-TCP', 'Gateway-to-Backend Direct Internal TCP Communication');
|
||||
const gwBackendRes = await gateway.exec(`nc -zv -w 3 ${backendName} 7681 2>&1`);
|
||||
log('PHASE3-TCP', 'Gateway-to-Backend Port Probe', gwBackendRes.output);
|
||||
const gwBackendOk = gwBackendRes.output.includes('open');
|
||||
recordResult('Inter-Service Mesh', 'soc-gateway -> soc-backend (Port 7681)', `${gatewayName} -> ${backendName}`, gwBackendOk ? 'PASS' : 'FAIL', gwBackendRes.output, 'Gateway probes backend over internal mesh');
|
||||
|
||||
// ==========================================
|
||||
// PHASE 4: EDGE INGRESS & PUBLIC REACHABILITY
|
||||
// ==========================================
|
||||
log('PHASE4-EDGE', 'External Edge Ingress Verification');
|
||||
try {
|
||||
const extFetch = await fetch(`https://${gatewayDomain}/`, { signal: AbortSignal.timeout(8000) });
|
||||
const extBody = await extFetch.text();
|
||||
const extOk = extFetch.status === 200;
|
||||
log('PHASE4-EDGE', `Public Edge Ingress (https://${gatewayDomain}/)`, `HTTP Status: ${extFetch.status}, Length: ${extBody.length}`);
|
||||
recordResult('Edge Ingress', 'Public Gateway URL', `https://${gatewayDomain}/`, extOk ? 'PASS' : 'FAIL', `HTTP Status: ${extFetch.status}`);
|
||||
} catch (e) {
|
||||
log('PHASE4-EDGE', 'Edge Ingress Error', e.message);
|
||||
recordResult('Edge Ingress', 'Public Gateway URL', `https://${gatewayDomain}/`, 'FAIL', e.message);
|
||||
}
|
||||
|
||||
// Verify private database has NO public route
|
||||
try {
|
||||
const redisExt = await fetch(`https://${redisName}.hosted.ghaymah.systems/`, { signal: AbortSignal.timeout(4000) });
|
||||
const redisExtStatus = redisExt.status;
|
||||
log('PHASE4-EDGE', 'Private Database Public Leak Test', `HTTP ${redisExtStatus}`);
|
||||
recordResult('Edge Ingress Isolation', 'Database External Unreachability', `https://${redisName}.hosted.ghaymah.systems/`, redisExtStatus === 404 || redisExtStatus === 502 || redisExtStatus === 503 ? 'PASS' : 'WARNING', `Status: ${redisExtStatus}`, 'Private service should not be exposed externally');
|
||||
} catch (e) {
|
||||
log('PHASE4-EDGE', 'Private Database Public Leak Test', 'Connection blocked or NXDOMAIN (Expected)');
|
||||
recordResult('Edge Ingress Isolation', 'Database External Unreachability', `${redisName}.hosted.ghaymah.systems`, 'PASS', e.message, 'Properly blocked at ingress');
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// PHASE 5: SECURITY & PENETRATION TESTING
|
||||
// ==========================================
|
||||
log('PHASE5-SEC', 'Security & Penetration Testing (Isolation, Lateral Movement, Egress)');
|
||||
|
||||
// Test 5.1: Intra-Tenant Cross-Project DNS Resolution
|
||||
// Target: test-redis from project dns-tcp-test
|
||||
const crossDns1 = await tester.exec('nslookup test-redis-feccbaec5bd7');
|
||||
log('PHASE5-SEC', 'Cross-Project DNS: test-redis-feccbaec5bd7', crossDns1.output);
|
||||
const crossDns1Resolved = crossDns1.output.includes('10.42.');
|
||||
recordResult('Security / Isolation', 'Cross-Project DNS (test-redis-feccbaec5bd7)', 'test-redis-feccbaec5bd7', crossDns1Resolved ? 'FINDING' : 'SECURE', crossDns1.output, crossDns1Resolved ? 'Intra-tenant cross-project DNS allowed' : 'Project isolated');
|
||||
|
||||
// Target: auth-deploy from project auth-deploy
|
||||
const crossDns2 = await tester.exec('nslookup auth-deploy-4c0bca85312b');
|
||||
log('PHASE5-SEC', 'Cross-Project DNS: auth-deploy-4c0bca85312b', crossDns2.output);
|
||||
const crossDns2Resolved = crossDns2.output.includes('10.42.');
|
||||
recordResult('Security / Isolation', 'Cross-Project DNS (auth-deploy-4c0bca85312b)', 'auth-deploy-4c0bca85312b', crossDns2Resolved ? 'FINDING' : 'SECURE', crossDns2.output, crossDns2Resolved ? 'Intra-tenant cross-project DNS allowed' : 'Project isolated');
|
||||
|
||||
// Test 5.2: Intra-Tenant Cross-Project TCP Lateral Movement
|
||||
const crossTcp1 = await tester.exec('nc -zv -w 3 test-redis-feccbaec5bd7 6379 2>&1');
|
||||
log('PHASE5-SEC', 'Cross-Project TCP: test-redis-feccbaec5bd7:6379', crossTcp1.output);
|
||||
const crossTcp1Open = crossTcp1.output.includes('open');
|
||||
recordResult('Security / Isolation', 'Cross-Project TCP Lateral Movement (Redis 6379)', 'test-redis-feccbaec5bd7:6379', crossTcp1Open ? 'FINDING' : 'SECURE', crossTcp1.output, crossTcp1Open ? 'Unrestricted intra-tenant cross-project TCP socket connection allowed' : 'TCP connection blocked by NetworkPolicy');
|
||||
|
||||
const crossHttp2 = await tester.exec('wget -qO- -T 3 http://auth-deploy-4c0bca85312b/ | head -n 3');
|
||||
log('PHASE5-SEC', 'Cross-Project HTTP: auth-deploy-4c0bca85312b:80', crossHttp2.output);
|
||||
const crossHttp2Open = crossHttp2.output.includes('<') || crossHttp2.output.includes('html');
|
||||
recordResult('Security / Isolation', 'Cross-Project HTTP Lateral Movement (Auth-deploy:80)', 'auth-deploy-4c0bca85312b:80', crossHttp2Open ? 'FINDING' : 'SECURE', crossHttp2.output, crossHttp2Open ? 'Cross-project HTTP communication succeeded' : 'HTTP blocked');
|
||||
|
||||
// Test 5.3: Infrastructure & Multi-Tenant Boundary Probing
|
||||
// Target: Kubernetes API Server
|
||||
const k8sApiProbe = await tester.exec('curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1');
|
||||
log('PHASE5-SEC', 'Kubernetes API Server Probe (10.43.0.1:443)', k8sApiProbe.output);
|
||||
recordResult('Security / Cluster Boundary', 'Kubernetes API Server (10.43.0.1:443)', '10.43.0.1:443', 'INFO', k8sApiProbe.output, 'Checks cluster API access controls');
|
||||
|
||||
// Target: Cloud Metadata Service (169.254.169.254)
|
||||
const metaProbe = await tester.exec('curl -s -m 3 http://169.254.169.254/latest/meta-data/ || echo "BLOCKED_OR_UNREACHABLE"');
|
||||
log('PHASE5-SEC', 'Cloud Metadata Service Probe (169.254.169.254)', metaProbe.output);
|
||||
const metaBlocked = metaProbe.output.includes('BLOCKED_OR_UNREACHABLE') || !metaProbe.output.trim();
|
||||
recordResult('Security / SSRF Isolation', 'Cloud Metadata Endpoint (169.254.169.254)', '169.254.169.254', metaBlocked ? 'PASS' : 'CRITICAL_LEAK', metaProbe.output, metaBlocked ? 'Cloud metadata endpoint unreachable' : 'CRITICAL: Metadata service exposed');
|
||||
|
||||
// Target: CoreDNS Prometheus Metrics (10.43.0.10:9153)
|
||||
const dnsMetrics = await tester.exec('curl -s -m 3 http://10.43.0.10:9153/metrics | head -n 5 || echo "BLOCKED"');
|
||||
log('PHASE5-SEC', 'CoreDNS Metrics Probe (10.43.0.10:9153)', dnsMetrics.output);
|
||||
recordResult('Security / Cluster Telemetry', 'CoreDNS Metrics (10.43.0.10:9153)', '10.43.0.10:9153', dnsMetrics.output.includes('coredns_') ? 'INFO' : 'SECURE', dnsMetrics.output);
|
||||
|
||||
// Test 5.4: Subnet Port Sweep & Lateral Discovery
|
||||
log('PHASE5-SEC', 'Scanning Local Subnet (10.42.5.95 - 10.42.5.105)');
|
||||
const scanCmd = `for i in $(seq 97 103); do nc -zv -w 1 10.42.5.$i 6379 2>&1 | grep open || true; nc -zv -w 1 10.42.5.$i 7681 2>&1 | grep open || true; done`;
|
||||
const scanRes = await tester.exec(scanCmd, 15000);
|
||||
log('PHASE5-SEC', 'Subnet Port Sweep Results', scanRes.output);
|
||||
recordResult('Security / Network Recon', 'Internal Subnet Port Sweep', '10.42.5.97-103', 'PASS', scanRes.output, 'Identified active service endpoints on overlay network');
|
||||
|
||||
// Test 5.5: Container Capabilities & Privilege Audit
|
||||
const capCheck = await tester.exec('grep Cap /proc/self/status && whoami');
|
||||
log('PHASE5-SEC', 'Container Privilege & Capabilities', capCheck.output);
|
||||
recordResult('Security / Container Hardening', 'Privilege & Capabilities', 'soc-tester', 'INFO', capCheck.output);
|
||||
|
||||
// Test 5.6: Egress NAT Public IP Discovery
|
||||
const egressIp = await tester.exec('curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org');
|
||||
log('PHASE5-SEC', 'Egress Public IP', egressIp.output);
|
||||
recordResult('Network / Egress NAT', 'Outbound Public IP', 'api.ipify.org', 'PASS', egressIp.output, 'Cluster node egress NAT IP');
|
||||
|
||||
tester.close();
|
||||
gateway.close();
|
||||
|
||||
log('COMPLETE', 'Multi-Microservice QA and Security Test Suite Complete! Results recorded.');
|
||||
console.log(`\nExecution Log saved to: ${LOG_FILE}`);
|
||||
console.log(`Structured Results saved to: ${RESULTS_FILE}`);
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,19 @@
|
||||
const { RemoteTerminal } = require('./remote_exec');
|
||||
|
||||
async function main() {
|
||||
const term = new RemoteTerminal();
|
||||
await term.connect();
|
||||
console.log('Connected to soc-tester pod!');
|
||||
|
||||
console.log('--- Probing soc-backend internal port 7681 ---');
|
||||
const res = await term.exec('nc -zv -w 3 soc-backend-d1895c70f6b2 7681 2>&1');
|
||||
console.log('NC:', res.output);
|
||||
|
||||
console.log('--- HTTP GET from soc-tester to soc-backend:7681 ---');
|
||||
const curl = await term.exec('curl -sI http://soc-backend-d1895c70f6b2:7681/ | head -n 5');
|
||||
console.log('CURL HEAD:', curl.output);
|
||||
|
||||
term.close();
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,30 @@
|
||||
const { RemoteTerminal } = require('./remote_exec');
|
||||
|
||||
async function main() {
|
||||
const term = new RemoteTerminal();
|
||||
await term.connect();
|
||||
console.log('Connected to soc-tester pod!');
|
||||
|
||||
console.log('--- Test 1: TCP Port Probe on soc-redis ---');
|
||||
const nc = await term.exec('nc -zv -w 3 soc-redis-10f420c389ef 6379 2>&1');
|
||||
console.log('Output:', nc.output);
|
||||
|
||||
console.log('--- Test 2: Raw TCP Redis PING ---');
|
||||
const pingCmd = 'printf "*1\\r\\n\\$4\\r\\nPING\\r\\n" | nc -w 3 soc-redis-10f420c389ef 6379';
|
||||
const ping = await term.exec(pingCmd);
|
||||
console.log('Output:', ping.output);
|
||||
|
||||
console.log('--- Test 3: Raw TCP Redis SET & GET ---');
|
||||
const setGetCmd = 'printf "*3\\r\\n\\$3\\r\\nSET\\r\\n\\$15\\r\\nsoc:mesh:status\\r\\n\\$16\\r\\nGHAYMAH_MESH_OK\\r\\n*2\\r\\n\\$3\\r\\nGET\\r\\n\\$15\\r\\nsoc:mesh:status\\r\\n" | nc -w 3 soc-redis-10f420c389ef 6379';
|
||||
const setGet = await term.exec(setGetCmd);
|
||||
console.log('Output:', setGet.output);
|
||||
|
||||
console.log('--- Test 4: Raw TCP Redis INFO ---');
|
||||
const infoCmd = 'printf "*1\\r\\n\\$4\\r\\nINFO\\r\\n" | nc -w 3 soc-redis-10f420c389ef 6379 | grep -E "redis_version|connected_clients|tcp_port|role"';
|
||||
const info = await term.exec(infoCmd);
|
||||
console.log('Output:', info.output);
|
||||
|
||||
term.close();
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,29 @@
|
||||
const url = 'wss://soc-tester-9b6540e2d4ed.hosted.ghaymah.systems/ws';
|
||||
|
||||
async function main() {
|
||||
console.log('Connecting to soc-tester terminal:', url);
|
||||
const ws = new WebSocket(url, ['tty']);
|
||||
|
||||
ws.onopen = () => {
|
||||
console.log('WebSocket opened successfully!');
|
||||
ws.send(JSON.stringify({ AuthToken: '' }));
|
||||
ws.send('1' + JSON.stringify({ columns: 120, rows: 40 }));
|
||||
setTimeout(() => {
|
||||
ws.send('0uname -a; hostname; cat /etc/resolv.conf\n');
|
||||
}, 500);
|
||||
};
|
||||
|
||||
ws.onmessage = (event) => {
|
||||
let text = typeof event.data === 'string' ? event.data : Buffer.from(event.data).toString('utf8');
|
||||
process.stdout.write(text.startsWith('0') ? text.substring(1) : text);
|
||||
};
|
||||
|
||||
ws.onerror = (err) => console.error('WS error:', err.message || err);
|
||||
|
||||
setTimeout(() => {
|
||||
console.log('\nClosing connection after 5 seconds...');
|
||||
ws.close();
|
||||
}, 5000);
|
||||
}
|
||||
|
||||
main().catch(console.error);
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"projectId": "5be77e31-3ac2-48f5-b97d-735e8b2ad45f",
|
||||
"projectName": "ghaymah-soc-microservices",
|
||||
"createdAt": "2026-10-12T20:53:21.986Z",
|
||||
"services": {
|
||||
"redis": {
|
||||
"id": "eb2efe06-e26e-4929-a1ee-120b9d364e77",
|
||||
"name": "soc-redis",
|
||||
"uniqueName": "soc-redis-10f420c389ef",
|
||||
"port": 6379,
|
||||
"expose": false
|
||||
},
|
||||
"backend": {
|
||||
"id": "471341bb-f102-4098-bf14-cc73ec8b2bad",
|
||||
"name": "soc-backend",
|
||||
"uniqueName": "soc-backend-d1895c70f6b2",
|
||||
"port": 4000,
|
||||
"expose": true,
|
||||
"domain": "soc-backend-d1895c70f6b2.hosted.ghaymah.systems"
|
||||
},
|
||||
"gateway": {
|
||||
"id": "3d5666fe-95db-4e73-b6b2-dd0e41fca7f6",
|
||||
"name": "soc-gateway",
|
||||
"uniqueName": "soc-gateway-28cd1dc4e034",
|
||||
"domain": "soc-gateway-28cd1dc4e034.hosted.ghaymah.systems",
|
||||
"port": 7681,
|
||||
"expose": true
|
||||
},
|
||||
"tester": {
|
||||
"id": "fb7d7eda-8585-46d5-9843-741b440de118",
|
||||
"name": "soc-tester",
|
||||
"uniqueName": "soc-tester-9b6540e2d4ed",
|
||||
"domain": "soc-tester-9b6540e2d4ed.hosted.ghaymah.systems",
|
||||
"port": 7681,
|
||||
"expose": true
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user