feat: initial commit of Ghaymah internal DNS, TCP and security testing suite and report

2026-10-12 23:43:09 +03:00
commit bdcd2d44f5
57 changed files with 6499 additions and 0 deletions
@@ -0,0 +1,69 @@
+# Ghaymah Systems — Private Networking & Internal DNS Testing Suite
+
+Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
+
+## 📋 Full Assessment Report
+Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures:
+👉 **[GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
+
+---
+
+## 🎯 Scope & Objectives
+1. **Internal DNS Verification**: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS `10.43.0.10:53`) using deterministic uniqueName identifiers (`[app-name]-[hash]`).
+2. **Raw TCP Connectivity**: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (`test-redis` on port 6379).
+3. **Security & Penetration Testing**:
+   - Cross-project lateral movement assessment within the same tenant.
+   - Cross-tenant and cluster infrastructure isolation verification.
+   - Network enumeration and port scanning.
+   - Dual routing and DNS leak detection.
+
+---
+
+## 📂 Directory Structure
+
+```text
+├── reports/
+│   └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md   # Final assessment report
+├── logs/
+│   ├── ghaymah_execution.log                    # Complete end-to-end execution log
+│   ├── uniquename_dns_tcp.log                   # Targeted uniqueName resolution & TCP test log
+│   ├── ghaymah_test_results.json                # Structured test results
+│   ├── 01_api_recon.md                          # Phase 2 API discovery
+│   └── 02_mcp_discovery.md                      # MCP tools discovery
+├── scripts/
+│   ├── run_comprehensive_ghaymah_tests.js       # End-to-end automated test runner
+│   ├── test_uniquename_dns_tcp.js               # Targeted DNS & TCP verification script
+│   ├── remote_exec.js                           # WebSocket terminal execution client
+│   ├── deploy_redis.js                          # Deploys private Redis container
+│   ├── deploy_terminal.js                       # Deploys diagnostic terminal container
+│   ├── build_and_deploy_apps.js                 # Artifact build & deployment pipeline
+│   └── auth_manager.js                          # Token management & caching
+└── sample_artifact.tar.gz                       # Reference Ghaymah build artifact
+```
+
+---
+
+## 📊 Summary of Findings
+
+| Test Area | Target | Status | Notes |
+| :--- | :--- | :---: | :--- |
+| **Internal DNS** | `test-redis-feccbaec5bd7` | **PASS** | Resolves to `10.42.5.97` via CoreDNS |
+| **Raw TCP** | `test-redis:6379` | **PASS** | `PING` $\rightarrow$ `+PONG`, `SET` $\rightarrow$ `+OK` |
+| **Tenant Isolation** | Cluster infrastructure / External tenants | **PASS** | `NXDOMAIN` / Timeouts for non-tenant resources |
+| **Project Isolation** | `auth-deploy-4c0bca85312b` (Separate project) | **FINDING** | **MEDIUM/HIGH**: Intra-tenant cross-project traffic allowed |
+| **Internet Egress** | `httpbin.org/ip` | **PASS** | NAT Gateway active (`184.107.141.203`) |
+| **DNS Leaks** | Upstream resolver | **PASS** | No leakage of internal/mesh queries |
+
+---
+
+## 🚀 Reproduction & Execution
+
+To execute the tests against the live Ghaymah deployment:
+
+```bash
+# 1. Run targeted uniqueName verification
+node scripts/test_uniquename_dns_tcp.js
+
+# 2. Run full test suite
+node scripts/run_comprehensive_ghaymah_tests.js
+```