Ziad_Abdelgwad/ghaymah-dns-net-sec-tests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: complete multi-microservice project deployment, internal DNS, raw TCP and security penetration report

Browse Source
This commit is contained in:
Ziad_Abdelgwad
2026-10-13 00:01:14 +03:00
parent bdcd2d44f5
commit 2cea9f25ba
15 changed files with 1405 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+55 -42
View File
@@ -1,21 +1,30 @@
# Ghaymah Systems — Private Networking & Internal DNS Testing Suite
# Ghaymah Systems — Private Networking, Internal DNS & Multi-Microservice Testing Suite
Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
## 📋 Full Assessment Report
Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures:
👉 **[GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
## 📋 Assessment Reports
1. 👉 **[Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)](reports/GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md)**
* Complete SOC multi-service topology: Edge Gateway, Private REST Backend, Private Redis Database, and Diagnostic Pod.
* Inter-service mesh routing, Raw TCP Redis transactions, and cross-project penetration testing findings.
2. 👉 **[Internal DNS & Private Networking Report (Project: dns-tcp-test)](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
* Baseline discovery, CoreDNS resolution formula verification, and tenant isolation benchmarks.
---
## 🎯 Scope & Objectives
1. **Internal DNS Verification**: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS `10.43.0.10:53`) using deterministic uniqueName identifiers (`[app-name]-[hash]`).
2. **Raw TCP Connectivity**: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (`test-redis` on port 6379).
3. **Security & Penetration Testing**:
- Cross-project lateral movement assessment within the same tenant.
- Cross-tenant and cluster infrastructure isolation verification.
- Network enumeration and port scanning.
- Dual routing and DNS leak detection.
1. **Multi-Microservice Architecture**: Deploy a real 4-tier microservice application directly on Ghaymah:
- `soc-gateway`: Public edge ingress, reverse proxy, and UI dashboard.
- `soc-backend`: Private analysis engine listening on port 4000.
- `soc-redis`: Private threat intelligence database & cache on port 6379.
- `soc-tester`: Live DevSecOps testing pod.
2. **Internal DNS Verification**: Verify container-to-container service discovery via CoreDNS (`10.43.0.10:53`) using deterministic unique names (`[name]-[hash]`).
3. **Raw TCP Socket Connectivity**: Validate non-HTTP socket communication over port 6379 (Redis handshake, write, read, atomic counters).
4. **Security & Penetration Testing**:
- Assess intra-tenant cross-project lateral movement.
- Verify cluster infrastructure isolation (Kubernetes API, Cloud Metadata SSRF).
- Local subnet discovery & port scanning.
- Outbound egress NAT and DNS leak behavior.
---
@@ -23,47 +32,51 @@ Read the full report with architecture diagrams, raw evidence, and vulnerability
```text
├── reports/
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Final assessment report
│ ├── GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md # Multi-microservice SOC assessment report
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Initial DNS & TCP baseline report
├── logs/
│ ├── ghaymah_execution.log # Complete end-to-end execution log
│ ├── uniquename_dns_tcp.log # Targeted uniqueName resolution & TCP test log
│ ├── ghaymah_test_results.json # Structured test results
│ ├── 01_api_recon.md # Phase 2 API discovery
│ └── 02_mcp_discovery.md # MCP tools discovery
│ ├── soc_multiservice_execution.log # Multi-microservice execution log
│ ├── soc_multiservice_results.json # Structured test results (JSON)
│ ├── ghaymah_execution.log # Baseline test execution log
│ └── uniquename_dns_tcp.log # Raw TCP test log
├── scripts/
│ ├── run_comprehensive_ghaymah_tests.js # End-to-end automated test runner
│ ├── test_uniquename_dns_tcp.js # Targeted DNS & TCP verification script
│ ├── remote_exec.js # WebSocket terminal execution client
│ ├── deploy_redis.js # Deploys private Redis container
│ ├── deploy_terminal.js # Deploys diagnostic terminal container
│ ├── build_and_deploy_apps.js # Artifact build & deployment pipeline
│ └── auth_manager.js # Token management & caching
└── sample_artifact.tar.gz # Reference Ghaymah build artifact
│ ├── create_soc_microservices_project.js # Deploys the multi-microservice project
│ ├── run_soc_multiservice_tests.js # Automated multi-service test runner
│ ├── monitor_soc_project.js # Deployment status polling
│ ├── remote_exec.js # WebSocket terminal execution client
│ ├── test_soc_redis_tcp.js # Raw TCP protocol tester
│ └── auth_manager.js # Ghaymah authentication manager
├── soc_project_topology.json # Full project resource definition & metadata
└── token.json # Authenticated session token (auto-managed)
```
---
## 📊 Summary of Findings
## 📊 Summary of Findings Matrix
| Test Area | Target | Status | Notes |
| :--- | :--- | :---: | :--- |
| **Internal DNS** | `test-redis-feccbaec5bd7` | **PASS** | Resolves to `10.42.5.97` via CoreDNS |
| **Raw TCP** | `test-redis:6379` | **PASS** | `PING` $\rightarrow$ `+PONG`, `SET` $\rightarrow$ `+OK` |
| **Tenant Isolation** | Cluster infrastructure / External tenants | **PASS** | `NXDOMAIN` / Timeouts for non-tenant resources |
| **Project Isolation** | `auth-deploy-4c0bca85312b` (Separate project) | **FINDING** | **MEDIUM/HIGH**: Intra-tenant cross-project traffic allowed |
| **Internet Egress** | `httpbin.org/ip` | **PASS** | NAT Gateway active (`184.107.141.203`) |
| **DNS Leaks** | Upstream resolver | **PASS** | No leakage of internal/mesh queries |
| Test Domain | Target Service | Result | Classification | Key Observation |
| :--- | :--- | :---: | :---: | :--- |
| **Internal DNS** | `soc-redis-10f420c389ef` | **PASS** | Functional | Resolves to `10.42.5.99` via CoreDNS |
| **Internal DNS** | `soc-backend-d1895c70f6b2`| **PASS** | Functional | Resolves to `10.42.5.103` via CoreDNS |
| **Internal DNS** | `soc-gateway-28cd1dc4e034`| **PASS** | Functional | Resolves to `10.42.5.101` via CoreDNS |
| **Raw TCP** | `soc-redis:6379` | **PASS** | Functional | `PING` $\rightarrow$ `+PONG`, `SET/GET` threat alerts verified |
| **Inter-Service Mesh** | `soc-gateway` $\rightarrow$ `soc-redis` | **PASS** | Functional | Edge Gateway queries Database directly over mesh |
| **Edge Ingress** | `soc-gateway` (Public URL) | **PASS** | Functional | HTTP 200 via `hosted.ghaymah.systems` |
| **Database Isolation**| `soc-redis` (Public Access) | **PASS** | Secure | HTTP 404 / Blocked from public internet |
| **Project Isolation**| Cross-project Redis/HTTP | **FINDING** | **Medium/High** | Projects in same account share flat mesh network |
| **Cluster Boundary** | K8s API (`10.43.0.1:443`) | **PASS** | Secure | HTTP 401 Unauthorized (RBAC enforced) |
| **SSRF / Cloud Meta** | AWS/Cloud Metadata (`169.254.169.254`) | **PASS** | Secure | Blocked / Unreachable |
| **Cluster Telemetry** | CoreDNS Metrics (`10.43.0.10:9153`) | **INFO** | Low | Prometheus metrics exposed internally |
---
## 🚀 Reproduction & Execution
To execute the tests against the live Ghaymah deployment:
## 🚀 Execution & Verification
To run the automated multi-microservice tests:
```bash
# 1. Run targeted uniqueName verification
node scripts/test_uniquename_dns_tcp.js
# 1. Verify Authentication
node scripts/auth_manager.js
# 2. Run full test suite
node scripts/run_comprehensive_ghaymah_tests.js
# 2. Run Comprehensive Test Suite
node scripts/run_soc_multiservice_tests.js
```