feat: initial commit of Ghaymah internal DNS, TCP and security testing suite and report

2026-10-12 23:43:09 +03:00
commit bdcd2d44f5
57 changed files with 6499 additions and 0 deletions
@@ -0,0 +1,37 @@
+# API Reconnaissance Findings - Phase 2
+## Date: 2026-10-12T21:27:00+03:00
+
+### Endpoint Discovery Summary
+
+| Endpoint | Status | Type | Notes |
+|----------|--------|------|-------|
+| `api.cumin.dev` | ✅ ACTIVE | REST + MCP | Token works, 49 MCP tools |
+| `api.cumin.dev/health` | ✅ 200 OK | JSON | `{"status":"OK"}` |
+| `api.cumin.dev/mcp` | ✅ 200 OK | MCP Protocol | Session initialized |
+| `deploy.ghaymah.systems` | ✅ 200 OK | React SPA | Vite-built, client-side routing |
+| `api.ghaymah.systems` | ❌ TIMEOUT | N/A | Port not open / unreachable |
+| `api.ghaymah.systems/health` | ❌ TIMEOUT | N/A | Port not open |
+| `api.ghaymah.systems/mcp` | ❌ TIMEOUT | N/A | Port not open |
+
+### Critical Finding: Ghaymah uses Cumin API Backend
+- The Ghaymah UI (`deploy.ghaymah.systems`) is a branded frontend
+- The actual API backend is `api.cumin.dev` (shared platform)
+- The Cumin token works for both platforms
+
+### MCP Tools (49 total - up from ~12):
+```json
+["add_star","app_logs","constellation_logs","create_api_token","create_app",
+"create_bucket","create_constellation","create_key","create_postgres","create_project",
+"create_pull_secret","create_secret","create_volume","delete_api_token","delete_app",
+"delete_bucket","delete_constellation","delete_key","delete_postgres","delete_project",
+"delete_pull_secret","delete_secret","delete_star_files","delete_volume","exec_in_app",
+"get_star_files","invoke_star","list_api_tokens","list_apps","list_buckets",
+"list_constellations","list_keys","list_postgres","list_projects","list_pull_secrets",
+"list_secrets","list_stars","list_volumes","patch_star_files","postgres_logs",
+"remove_star","replace_star_files","update_app","update_bucket","update_constellation",
+"update_postgres","update_project","update_pull_secret","update_secret"]
+```
+
+### Existing Deployed Apps:
+- `soc-gateway` (ID: `0db0f9b0-f452-4d9a-9379-c5dd9e209df3`) - running
+- `soc-backend` (ID: `d1309ed4-9442-4623-adde-0419c99c8d70`) - running
@@ -0,0 +1,29 @@
+# MCP Deep Discovery Findings - Phase 2B
+## Date: 2026-10-12T21:31:00+03:00
+
+### DNS Infrastructure Discovery
+- **resolv.conf**: `nameserver 127.0.0.1` + `search mesh`
+- **Local DNS resolver**: Running at `127.0.0.1:53` inside containers
+- **Search domain**: `.mesh` — suggesting DNS names resolve as `<name>.mesh`
+- **Current DNS state**: All patterns return NXDOMAIN — apps may need specific tag matching
+
+### DNS Resolution Test Results (from soc-backend)
+| Pattern | Result |
+|---------|--------|
+| `soc-gateway` | NXDOMAIN |
+| `soc-gateway.mesh` | NXDOMAIN |
+| `soc-gateway.local` | NXDOMAIN |
+| `soc-gateway.soc-private-net` | NXDOMAIN |
+| `soc-gateway.project.mesh` | NXDOMAIN |
+| `soc-gateway.cumin.internal` | NXDOMAIN |
+
+### App Object Schema Keys
+`id, created_at, updated_at, cpu, memory, project_id, name, image, args, ports, env, mounts, instances, hibernated, tags, status, alias`
+
+### New Fields Discovered
+- **`alias`** field on both apps and constellations
+- **`tags`** field: key-value pairs (e.g., `{"component":"gateway","platform":"soc"}`)
+- Constellation alias: `soc-private-net-ad145d86`
+
+### Hypothesis
+The Internal DNS feature likely requires apps to share the **same tag** for mutual DNS discovery. The `.mesh` search domain suggests names resolve as `<app-name>.mesh` but only within the same tag scope.
@@ -0,0 +1,75 @@
+[2026-10-12T18:51:19.005Z] === PHASE 3: DNS & TCP FUNCTIONALITY TESTING ===
+
+[2026-10-12T18:51:19.660Z] ✅ MCP Connected
+
+[2026-10-12T18:51:19.660Z] 📦 Deploying dns-test-server (TCP + HTTP)...
+[2026-10-12T18:51:24.880Z]   Server deploy result: {
+  "id": "74401df6-9097-442b-bfe9-4de9d60a889c"
+}
+[2026-10-12T18:51:24.880Z] 
+📦 Deploying dns-test-client...
+[2026-10-12T18:51:29.883Z]   Client deploy result: {
+  "id": "8029db40-f90e-4eee-8bb3-626ca7038049"
+}
+[2026-10-12T18:51:29.883Z] 
+⏳ Waiting 25 seconds for apps to boot...
+
+[2026-10-12T18:51:54.887Z] === Checking deployed app status ===
+[2026-10-12T18:51:55.790Z]   soc-gateway: Healthy (tags: {"component":"gateway","platform":"soc"})
+[2026-10-12T18:51:55.790Z]   dns-test-server: Deploying (tags: {"platform":"soc","role":"dns-test","tier":"backend"})
+[2026-10-12T18:51:55.790Z]   dns-test-client: Deploying (tags: {"platform":"soc","role":"dns-test","tier":"frontend"})
+[2026-10-12T18:51:55.790Z]   soc-backend: Healthy (tags: {"component":"backend","platform":"soc"})
+[2026-10-12T18:51:55.790Z] 
+=== SERVER NETWORK INFO ===
+[2026-10-12T18:51:56.458Z]   ip addr: {
+  "stdout": "1: lo: \u003cLOOPBACK,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 127.0.0.1/8 scope global dynamic \n2: eth0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 172.26.69.146/20 scope global dynamic \n3: wg0: \u003cPOINTOPOINT,NOARP,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 10.100.0.64/20 scope global dynamic \n",
+  "stderr": "",
+  "exit_code": 0
+}
+[2026-10-12T18:51:56.853Z]   resolv.conf: {
+  "stdout": "nameserver 127.0.0.1\nsearch mesh\n",
+  "stderr": "",
+  "exit_code": 0
+}
+[2026-10-12T18:51:56.853Z] 
+=== CLIENT NETWORK INFO ===
+[2026-10-12T18:51:57.299Z]   ip addr: {
+  "stdout": "3: wg0: \u003cPOINTOPOINT,NOARP,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 10.100.0.66/20 scope global dynamic \n1: lo: \u003cLOOPBACK,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 127.0.0.1/8 scope global dynamic \n2: eth0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 0 qlen 1000\n    inet 172.26.69.147/20 scope global dynamic \n",
+  "stderr": "",
+  "exit_code": 0
+}
+[2026-10-12T18:51:57.684Z]   resolv.conf: {
+  "stdout": "nameserver 127.0.0.1\nsearch mesh\n",
+  "stderr": "",
+  "exit_code": 0
+}
+[2026-10-12T18:51:57.684Z] 
+=== DNS RESOLUTION TESTS (from client container) ===
+[2026-10-12T18:51:58.168Z]   getent hosts dns-test-server → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:51:58.554Z]   getent hosts dns-test-server.mesh → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:51:59.056Z]   getent hosts soc-backend → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:51:59.519Z]   getent hosts soc-backend.mesh → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:51:59.956Z]   getent hosts soc-gateway → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:52:00.458Z]   getent hosts soc-gateway.mesh → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:52:00.818Z]   getent hosts dns-test-client → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:52:01.187Z]   getent hosts dns-test-client.mesh → {"stdout":"","stderr":"","exit_code":2}
+[2026-10-12T18:52:01.187Z] 
+--- nslookup tests ---
+[2026-10-12T18:52:01.593Z]   nslookup dns-test-server → {"stdout":"Server:\t\t127.0.0.1\nAddress:\t127.0.0.1:53\n\n** server can't find dns-test-server.mesh: NXDOMAIN\n\n** server can't find dns-test-server.mesh: NXDOMAIN\n\n","stderr":"","exit_code":1}
+[2026-10-12T18:52:01.997Z]   nslookup soc-backend → {"stdout":"Server:\t\t127.0.0.1\nAddress:\t127.0.0.1:53\n\n** server can't find soc-backend.mesh: NXDOMAIN\n\n** server can't find soc-backend.mesh: NXDOMAIN\n\n","stderr":"","exit_code":1}
+[2026-10-12T18:52:01.997Z] 
+=== TCP CONNECTION TESTS ===
+[2026-10-12T18:52:02.404Z]   Server WireGuard IP: 10.100.0.64
+[2026-10-12T18:52:02.404Z] 
+  Testing TCP connection to 10.100.0.64:9000...
+[2026-10-12T18:52:05.761Z]   TCP via IP → {"stdout":"","stderr":"","exit_code":1}
+[2026-10-12T18:52:05.761Z]   Testing HTTP connection to 10.100.0.64:4000...
+[2026-10-12T18:52:06.188Z]   HTTP via IP → {"stdout":"{\"service\":\"dns-test-server\",\"hostname\":\"77745c23df30\",\"interfaces\":{\"wg0\":[\"10.100.0.64\"],\"lo\":[\"127.0.0.1\"],\"eth0\":[\"172.26.69.146\"]},\"uptime\":15.954253844,\"env\":{\"PORT\":\"4000\",\"NODE_VERSION\":\"v22.23.3\"}}","stderr":"","exit_code":0}
+[2026-10-12T18:52:06.188Z] 
+  Testing TCP connection via DNS name dns-test-server:9000...
+[2026-10-12T18:52:06.594Z]   TCP via DNS → {"stdout":"nc: bad address 'dns-test-server'\nDNS_TCP_FAILED\n","stderr":"","exit_code":0}
+[2026-10-12T18:52:06.594Z] 
+  Testing HTTP connection via DNS name dns-test-server:4000...
+[2026-10-12T18:52:06.982Z]   HTTP via DNS → {"stdout":"wget: bad address 'dns-test-server:4000'\nDNS_HTTP_FAILED\n","stderr":"","exit_code":0}
+[2026-10-12T18:52:06.982Z] 
+=== PHASE 3 COMPLETE ===
@@ -0,0 +1,20 @@
+[2026-10-12T19:18:25.242Z] [AUTH] Authenticated as d62f9886-fced-4cf2-98e4-5b62000d4f03
+[2026-10-12T19:18:25.243Z] [WAIT] Waiting for apps to deploy (polling every 15s, max 3min)...
+[2026-10-12T19:18:25.668Z] [WAIT] Attempt 1: AppA=synced | AppB=synced
+[2026-10-12T19:18:25.668Z] [WAIT]   AppA message: Successfully deployed
+[2026-10-12T19:18:25.668Z] [WAIT]   AppB message: Successfully deployed
+[2026-10-12T19:18:25.668Z] [WAIT] Getting app URLs...
+[2026-10-12T19:18:25.952Z] [WAIT] Total apps now: 1
+[2026-10-12T19:18:25.952Z] [WAIT]   index-aacd4c19 | status: Healthy | ports: [{"name":"web","number":80,"hostname":"https://index-aacd4c19-web-435622ba.hosted.cumin.dev"}]
+[2026-10-12T19:18:26.373Z] [STATUS] All resources:
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-project | scanner-clean | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-project | symlink-attack | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-project | auth-deploy | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-project | dns-tcp-test | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-app | scanner-clean | backoff | Failed: failed to install release: failed pre-install: 1 error occurred:
+	* job scanner-clean-5da8ba711718-build failed: BackoffLimitExceeded
+
+
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-app | auth-deploy | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-app | tcp-test-client | synced | Successfully deployed
+[2026-10-12T19:18:26.374Z] [STATUS]   ghaymah-app | tcp-echo-server | synced | Successfully deployed
@@ -0,0 +1,165 @@
+[2026-10-12T18:52:32.149Z] === PHASE 4: SECURITY & PENETRATION TESTING ===
+
+[2026-10-12T18:52:33.765Z] ✅ MCP Connected
+
+[2026-10-12T18:52:34.586Z] Deployed apps:
+[2026-10-12T18:52:34.587Z]   soc-gateway (0db0f9b0) - Healthy - tags: {"component":"gateway","platform":"soc"}
+[2026-10-12T18:52:34.587Z]   dns-test-server (74401df6) - Healthy - tags: {"platform":"soc","role":"dns-test","tier":"backend"}
+[2026-10-12T18:52:34.587Z]   dns-test-client (8029db40) - Healthy - tags: {"platform":"soc","role":"dns-test","tier":"frontend"}
+[2026-10-12T18:52:34.587Z]   soc-backend (d1309ed4) - Healthy - tags: {"component":"backend","platform":"soc"}
+[2026-10-12T18:52:34.587Z] 
+Using soc-backend (d1309ed4-9442-4623-adde-0419c99c8d70) as pen-test host
+
+[2026-10-12T18:52:34.587Z] === TEST 1: ISOLATION & LATERAL MOVEMENT ===
+[2026-10-12T18:52:34.587Z] Objective: Attempt to reach apps in DIFFERENT projects or with DIFFERENT tags
+
+[2026-10-12T18:52:34.587Z] --- 1a. Lateral Movement via Direct IP Probing ---
+[2026-10-12T18:52:37.954Z]   10.100.0.1 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:41.374Z]   10.100.0.2 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:44.766Z]   10.100.0.10 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:48.154Z]   10.100.0.50 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:51.545Z]   10.100.0.200 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:54.951Z]   10.100.0.254 → wget: download timed out
+BLOCKED
+[2026-10-12T18:52:58.402Z]   10.100.1.1 → wget: download timed out
+BLOCKED
+[2026-10-12T18:53:01.757Z]   172.17.0.1 → wget: download timed out
+BLOCKED
+[2026-10-12T18:53:05.152Z]   172.26.64.1 → wget: download timed out
+BLOCKED
+[2026-10-12T18:53:08.460Z]   192.168.1.1 → wget: download timed out
+BLOCKED
+[2026-10-12T18:53:08.460Z] 
+--- 1b. Cross-Tenant DNS Resolution Attempts ---
+[2026-10-12T18:53:08.863Z]   DNS other-project-app → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find other-project-app.mesh: NXDOMAIN
+[2026-10-12T18:53:09.352Z]   DNS admin-panel → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find admin-panel.mesh: NXDOMAIN
+[2026-10-12T18:53:09.856Z]   DNS database.default → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find database.default: NXDOMAIN
+[2026-10-12T18:53:10.355Z]   DNS kubernetes.default.svc → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find kubernetes.default.svc: NXDOMAIN
+[2026-10-12T18:53:10.785Z]   DNS metadata.google.internal → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find metadata.google.internal: NXDOMAIN
+[2026-10-12T18:53:11.193Z]   DNS 169.254.169.254 → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find 254.169.254.169.in-addr.arpa: NXDOMAIN
+[2026-10-12T18:53:11.663Z]   DNS consul.service.consul → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find consul.service.consul: NXDOMAIN
+[2026-10-12T18:53:12.162Z]   DNS nomad.service.consul → Server:		127.0.0.1
+Address:	127.0.0.1:53
+
+** server can't find nomad.service.consul: NXDOMAIN
+[2026-10-12T18:53:12.162Z] 
+--- 1c. Cloud Metadata Service Access Attempt ---
+[2026-10-12T18:53:15.558Z]   Metadata http://169.254.169.254/latest/meta-data/... → wget: download timed out
+[2026-10-12T18:53:18.874Z]   Metadata http://169.254.169.254/metadata/instance... → wget: download timed out
+[2026-10-12T18:53:19.378Z]   Metadata http://metadata.google.internal/computeM... → wget: bad address 'metadata.google.internal'
+[2026-10-12T18:53:22.760Z]   Metadata http://100.100.100.200/latest/meta-data/... → wget: download timed out
+[2026-10-12T18:53:22.760Z] 
+=== TEST 2: NETWORK ENUMERATION ===
+[2026-10-12T18:53:22.760Z] Objective: Scan for unintended open ports on internal network
+
+[2026-10-12T18:53:23.254Z]   Our WireGuard IP: 10.100.2.93
+[2026-10-12T18:53:23.254Z] 
+--- 2a. Port Scan on 10.100.0.1 (Mesh Gateway) ---
+[2026-10-12T18:53:25.652Z]   10.100.0.1:22 → CLOSED
+[2026-10-12T18:53:27.957Z]   10.100.0.1:53 → CLOSED
+[2026-10-12T18:53:30.454Z]   10.100.0.1:80 → CLOSED
+[2026-10-12T18:53:32.815Z]   10.100.0.1:443 → CLOSED
+[2026-10-12T18:53:35.159Z]   10.100.0.1:3000 → CLOSED
+[2026-10-12T18:53:37.551Z]   10.100.0.1:4000 → CLOSED
+[2026-10-12T18:53:39.952Z]   10.100.0.1:5432 → CLOSED
+[2026-10-12T18:53:42.351Z]   10.100.0.1:6379 → CLOSED
+[2026-10-12T18:53:44.760Z]   10.100.0.1:8080 → CLOSED
+[2026-10-12T18:53:47.129Z]   10.100.0.1:8443 → CLOSED
+[2026-10-12T18:53:49.465Z]   10.100.0.1:9000 → CLOSED
+[2026-10-12T18:53:51.851Z]   10.100.0.1:9090 → CLOSED
+[2026-10-12T18:53:54.251Z]   10.100.0.1:27017 → CLOSED
+[2026-10-12T18:53:54.751Z] 
+--- 2b. Port Scan on 10.100.2.134 (soc-gateway) ---
+[2026-10-12T18:53:57.088Z]   10.100.2.134:22 → CLOSED
+[2026-10-12T18:53:59.478Z]   10.100.2.134:53 → CLOSED
+[2026-10-12T18:54:01.846Z]   10.100.2.134:80 → CLOSED
+[2026-10-12T18:54:04.263Z]   10.100.2.134:443 → CLOSED
+[2026-10-12T18:54:04.731Z]   10.100.2.134:3000 → OPEN
+[2026-10-12T18:54:07.102Z]   10.100.2.134:4000 → CLOSED
+[2026-10-12T18:54:09.457Z]   10.100.2.134:5432 → CLOSED
+[2026-10-12T18:54:11.853Z]   10.100.2.134:6379 → CLOSED
+[2026-10-12T18:54:14.218Z]   10.100.2.134:8080 → CLOSED
+[2026-10-12T18:54:16.557Z]   10.100.2.134:8443 → CLOSED
+[2026-10-12T18:54:18.987Z]   10.100.2.134:9000 → CLOSED
+[2026-10-12T18:54:21.424Z]   10.100.2.134:9090 → CLOSED
+[2026-10-12T18:54:23.737Z]   10.100.2.134:27017 → CLOSED
+[2026-10-12T18:54:23.737Z] 
+--- 2c. Self Port Scan (localhost) ---
+[2026-10-12T18:54:24.150Z]   127.0.0.1:22 → CLOSED
+[2026-10-12T18:54:24.653Z]   127.0.0.1:53 → OPEN
+[2026-10-12T18:54:25.079Z]   127.0.0.1:80 → CLOSED
+[2026-10-12T18:54:25.464Z]   127.0.0.1:443 → CLOSED
+[2026-10-12T18:54:25.890Z]   127.0.0.1:3000 → CLOSED
+[2026-10-12T18:54:26.261Z]   127.0.0.1:4000 → OPEN
+[2026-10-12T18:54:26.769Z]   127.0.0.1:5432 → CLOSED
+[2026-10-12T18:54:27.264Z]   127.0.0.1:6379 → CLOSED
+[2026-10-12T18:54:27.782Z]   127.0.0.1:8080 → CLOSED
+[2026-10-12T18:54:28.250Z]   127.0.0.1:9000 → CLOSED
+[2026-10-12T18:54:28.661Z]   127.0.0.1:9090 → CLOSED
+[2026-10-12T18:54:28.661Z] 
+=== TEST 3: DUAL ROUTING & DNS LEAK DETECTION ===
+[2026-10-12T18:54:28.661Z] Objective: Verify external internet works AND internal DNS doesn't leak
+
+[2026-10-12T18:54:28.661Z] --- 3a. External Internet Connectivity ---
+[2026-10-12T18:54:29.357Z]   https://www.google.com → <!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en-CA"><head><meta cont
+[2026-10-12T18:54:30.161Z]   https://api.github.com → {"current_user_url":"https://api.github.com/user","current_user_authorizations_html_url":"https://gi
+[2026-10-12T18:54:30.643Z]   https://1.1.1.1/dns-query → wget: server returned error: HTTP/1.1 400 Bad Request
+[2026-10-12T18:54:30.643Z] 
+--- 3b. DNS Leak Detection ---
+[2026-10-12T18:54:31.055Z]   resolv.conf → nameserver 127.0.0.1
+search mesh
+[2026-10-12T18:54:31.502Z]   External DNS (8.8.8.8) query → Server:		8.8.8.8
+Address:	8.8.8.8:53
+
+** server can't find dns-test-server: NXDOMAIN
+[2026-10-12T18:54:31.958Z]   Google DNS leak test → Server:		ns1.google.com
+Address:	216.239.32.10:53
+
+o-o.myaddr.l.google.com	text = "69.157.244.191"
+[2026-10-12T18:54:31.958Z] 
+--- 3c. Routing Table ---
+[2026-10-12T18:54:32.508Z]   Routes: default via 172.26.64.1 dev eth0 
+10.100.0.0/20 dev wg0 scope link 
+172.26.64.0/20 dev eth0 scope link 
+local 10.100.2.93 dev wg0 scope host 
+broadcast 10.100.15.255 dev wg0 scope link 
+local 127.0.0.0/8 dev lo scope host 
+local 127.0.0.1 dev lo scope host 
+broadcast 127.255.255.255 dev lo scope link 
+local 172.26.64.26 dev eth0 scope host 
+broadcast 172.26.79.255 dev eth0 scope link 
+fe80::/64 dev eth0 
+local ::1 dev lo 
+local fe80::a8cc:e4ff:fe88:d148 dev eth0 
+multicast ff00::/8 dev eth0
+[2026-10-12T18:54:32.508Z] 
+--- 3d. Firewall Rules ---
+[2026-10-12T18:54:32.951Z]   iptables: sh: iptables: not found
+[2026-10-12T18:54:32.951Z] 
+=== PHASE 4 COMPLETE ===
@@ -0,0 +1,390 @@
+[2026-10-12T20:27:01.135Z] [INIT] === STARTING COMPREHENSIVE GHAYMAH PLATFORM TESTS ===
+
+[2026-10-12T20:27:01.140Z] [INIT] Target: Ghaymah Systems (deploy.ghaymah.systems)
+
+[2026-10-12T20:27:01.140Z] [INIT] Project: dns-tcp-test (3f55ceef-78ae-40c8-a41b-0505db8c59ee)
+
+[2026-10-12T20:27:01.141Z] [INIT] Client Container: client-terminal (tsl0922/ttyd:alpine)
+
+[2026-10-12T20:27:01.141Z] [INIT] Target Container: test-redis (redis:alpine)
+
+[2026-10-12T20:27:02.461Z] [INIT] RemoteTerminal connected via WebSocket to Ghaymah pod!
+
+[2026-10-12T20:27:02.462Z] [PRE-FLIGHT] Checking container environment tools...
+
+[2026-10-12T20:27:02.604Z] [PRE-FLIGHT] Available tools in Alpine container:
+/usr/bin/nslookup
+/usr/bin/nc
+/usr/bin/wget
+/sbin/ip
+/usr/bin/awk
+/bin/grep
+
+[2026-10-12T20:27:02.605Z] [PHASE3-ENV] === PHASE 3.1: CONTAINER ENVIRONMENT & NETWORK DISCOVERY ===
+
+[2026-10-12T20:27:02.750Z] [PHASE3-ENV] Container identity:
+root
+uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw
+
+[2026-10-12T20:27:02.892Z] [PHASE3-ENV] Network interfaces (ip addr):
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host 
+       valid_lft forever preferred_lft forever
+2: eth0@if43491: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000
+    link/ether a6:44:41:9e:20:3b brd ff:ff:ff:ff:ff:ff
+    inet 10.42.5.98/24 brd 10.42.5.255 scope global eth0
+       valid_lft forever preferred_lft forever
+
+[2026-10-12T20:27:03.028Z] [PHASE3-ENV] Routing table (ip route):
+default via 10.42.5.1 dev eth0 
+10.42.0.0/16 via 10.42.5.1 dev eth0 
+10.42.5.0/24 dev eth0 scope link  src 10.42.5.98
+
+[2026-10-12T20:27:03.191Z] [PHASE3-ENV] DNS Configuration (/etc/resolv.conf):
+search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net
+nameserver 10.43.0.10
+options ndots:5
+
+[2026-10-12T20:27:03.192Z] [PHASE3-DNS] === PHASE 3.2: INTERNAL DNS VERIFICATION ===
+
+[2026-10-12T20:27:03.194Z] [PHASE3-DNS] Objective: Prove App A discovers App B using internal DNS hostnames (not direct IP)
+
+[2026-10-12T20:27:03.194Z] [PHASE3-DNS] Test 1: nslookup test-redis
+
+[2026-10-12T20:27:03.429Z] [PHASE3-DNS] Result (test-redis):
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis.cluster.local: NXDOMAIN
+
+** server can't find test-redis.cluster.local: NXDOMAIN
+
+** server can't find test-redis.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find test-redis.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:27:03.430Z] [PHASE3-DNS] Test 2: getent hosts test-redis
+
+[2026-10-12T20:27:03.869Z] [PHASE3-DNS] Result (getent / ping test-redis):
+ping: bad address 'test-redis'
+
+[2026-10-12T20:27:03.870Z] [PHASE3-DNS] Test 3: nslookup test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+
+[2026-10-12T20:27:04.084Z] [PHASE3-DNS] Result (test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local):
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+[2026-10-12T20:27:04.259Z] [PHASE3-DNS] Pattern test-redis.mesh:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.mesh: NXDOMAIN
+
+** server can't find test-redis.mesh: NXDOMAIN
+
+[2026-10-12T20:27:04.421Z] [PHASE3-DNS] Pattern test-redis.dns-tcp-test.mesh:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.dns-tcp-test.mesh: NXDOMAIN
+
+** server can't find test-redis.dns-tcp-test.mesh: NXDOMAIN
+
+[2026-10-12T20:27:04.564Z] [PHASE3-DNS] Pattern test-redis.local:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.local: NXDOMAIN
+
+** server can't find test-redis.local: NXDOMAIN
+
+[2026-10-12T20:27:04.797Z] [PHASE3-DNS] Pattern test-redis.internal:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find test-redis.internal: NXDOMAIN
+
+** server can't find test-redis.internal: NXDOMAIN
+
+[2026-10-12T20:27:04.798Z] [PHASE3-TCP] === PHASE 3.3: RAW TCP CONNECTIONS (NON-HTTP) ===
+
+[2026-10-12T20:27:04.799Z] [PHASE3-TCP] Target: test-redis on port 6379 over private network
+
+[2026-10-12T20:27:04.800Z] [PHASE3-TCP] Test 1: TCP Port Probe via DNS Hostname (nc -z -w 3 test-redis 6379)
+
+[2026-10-12T20:27:04.973Z] [PHASE3-TCP] TCP probe exit code:
+1
+
+[2026-10-12T20:27:04.974Z] [PHASE3-TCP] Test 2: Raw TCP Handshake: Send PING\r\n -> Expect +PONG\r\n
+
+[2026-10-12T20:27:05.191Z] [PHASE3-TCP] Redis PING response:
+nc: bad address 'test-redis'
+
+[2026-10-12T20:27:05.193Z] [PHASE3-TCP] Test 3: Raw TCP Data Exchange: SET ghaymah_test "OK_TCP_WORKS" && GET ghaymah_test
+
+[2026-10-12T20:27:15.197Z] [PHASE3-TCP] Redis SET & GET response:
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# 
+␍client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# printf "*3\r\n\$3\r\nSET\r\n\$12\r\nghaymah_test\r\n\$11\r\nOK_TCP_PASS\r\n" | nc -w 3 test-redis 6379
+␍nc: bad address 'test-redis'
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# printf "*2\r\n\$3\r\nGET\r\n\$12\r\nghaymah_test\r\n" | nc -w 3 test-redis 6379
+␍nc: bad address 'test-redis'
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# ; echo __RET__$?_ma3g0t__END__
+␍bash: syntax error near unexpected token `;'
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~#
+
+[2026-10-12T20:27:15.201Z] [PHASE4-ISO] === PHASE 4.1: SECURITY ISOLATION & SCOPING ===
+
+[2026-10-12T20:27:15.202Z] [PHASE4-ISO] Objective: Test lateral movement and cross-project isolation
+
+[2026-10-12T20:27:15.436Z] [PHASE4-ISO] Cross-project DNS lookup for 'auth-deploy':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find auth-deploy.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find auth-deploy.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:27:15.685Z] [PHASE4-ISO] Cross-project DNS lookup for 'auth-deploy.mesh':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find auth-deploy.mesh: NXDOMAIN
+
+** server can't find auth-deploy.mesh: NXDOMAIN
+
+[2026-10-12T20:27:15.821Z] [PHASE4-ISO] Cross-project DNS lookup for 'auth-deploy.local':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find auth-deploy.local: NXDOMAIN
+
+** server can't find auth-deploy.local: NXDOMAIN
+
+[2026-10-12T20:27:16.061Z] [PHASE4-ISO] Cross-project DNS lookup for 'scanner-clean':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find scanner-clean.svc.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.svc.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find scanner-clean.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find scanner-clean.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:27:16.202Z] [PHASE4-ISO] Cross-project DNS lookup for 'scanner-clean.mesh':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find scanner-clean.mesh: NXDOMAIN
+
+** server can't find scanner-clean.mesh: NXDOMAIN
+
+[2026-10-12T20:27:16.340Z] [PHASE4-ISO] Cross-tenant DNS lookup for 'kubernetes.default.svc':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find kubernetes.default.svc: NXDOMAIN
+
+** server can't find kubernetes.default.svc: NXDOMAIN
+
+[2026-10-12T20:27:16.488Z] [PHASE4-ISO] Cross-tenant DNS lookup for 'metadata.google.internal':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find metadata.google.internal: NXDOMAIN
+
+** server can't find metadata.google.internal: NXDOMAIN
+
+[2026-10-12T20:27:16.675Z] [PHASE4-ISO] Cross-tenant DNS lookup for 'admin-panel':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find admin-panel.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.svc.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.svc.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN
+
+** server can't find admin-panel.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find admin-panel.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:27:16.816Z] [PHASE4-ISO] Cross-tenant DNS lookup for 'backend.internal':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find backend.internal: NXDOMAIN
+
+** server can't find backend.internal: NXDOMAIN
+
+[2026-10-12T20:27:16.959Z] [PHASE4-ISO] Cross-tenant DNS lookup for 'database.default':
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find database.default: NXDOMAIN
+
+** server can't find database.default: NXDOMAIN
+
+[2026-10-12T20:27:16.961Z] [PHASE4-ISO] Probing adjacent internal IP subnets (10.42.0.0/16, 10.43.0.0/16, 10.100.0.0/16)...
+
+[2026-10-12T20:27:26.974Z] [PHASE4-ISO] IP Probe 10.43.0.1: exit code -1
+
+[2026-10-12T20:27:36.986Z] [PHASE4-ISO] IP Probe 10.43.0.10: exit code -1
+
+[2026-10-12T20:27:46.995Z] [PHASE4-ISO] IP Probe 10.42.5.1: exit code -1
+
+[2026-10-12T20:27:57.024Z] [PHASE4-ISO] IP Probe 10.100.0.1: exit code -1
+
+[2026-10-12T20:28:07.030Z] [PHASE4-ISO] IP Probe 10.100.0.2: exit code -1
+
+[2026-10-12T20:28:17.035Z] [PHASE4-ISO] IP Probe 172.17.0.1: exit code -1
+
+[2026-10-12T20:28:27.051Z] [PHASE4-ISO] IP Probe 169.254.169.254: exit code -1
+
+[2026-10-12T20:28:27.054Z] [PHASE4-SCAN] === PHASE 4.2: NETWORK ENUMERATION ===
+
+[2026-10-12T20:28:27.054Z] [PHASE4-SCAN] Scanning ports on test-redis...
+
+[2026-10-12T20:28:37.062Z] [PHASE4-SCAN] Port scan results on test-redis:
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# for p in 22 53 80 443 3000 4000 5432 6379 8080 9000; do
+␍>   nc -z -w 1 test-redis $p && echo "PORT $p OPEN" || echo "PORT $p CLOSED"
+␍> done
+␍nc: bad address 'test-redis'
+PORT 22 CLOSED
+nc: bad address 'test-redis'
+PORT 53 CLOSED
+nc: bad address 'test-redis'
+PORT 80 CLOSED
+nc: bad address 'test-redis'
+PORT 443 CLOSED
+nc: bad address 'test-redis'
+PORT 3000 CLOSED
+nc: bad address 'test-redis'
+PORT 4000 CLOSED
+nc: bad address 'test-redis'
+PORT 5432 CLOSED
+nc: bad address 'test-redis'
+PORT 6379 CLOSED
+nc: bad address 'test-redis'
+PORT 8080 CLOSED
+nc: bad address 'test-redis'
+PORT 9000 CLOSED
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# ; echo __RET__$?_iwjsdj__END__
+␍bash: syntax error near unexpected token `;'
+client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~#
+
+[2026-10-12T20:28:37.063Z] [PHASE4-LEAK] === PHASE 4.3: DUAL ROUTING & DNS LEAK DETECTION ===
+
+[2026-10-12T20:28:37.064Z] [PHASE4-LEAK] Test 1: External internet egress via HTTP (httpbin.org/ip)...
+
+[2026-10-12T20:28:38.001Z] [PHASE4-LEAK] Public Egress IP response:
+{
+  "origin": "184.107.141.203"
+}
+
+[2026-10-12T20:28:38.268Z] [PHASE4-LEAK] External DNS resolution for google.com:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+Non-authoritative answer:
+Name:	google.com
+Address: 2607:f8b0:4020:c07::66
+Name:	google.com
+Address: 2607:f8b0:4020:c07::64
+Name:	google.com
+Address: 2607:f8b0:4020:c07::71
+Name:	google.com
+Address: 2607:f8b0:4020:c07::8b
+
+Non-authoritative answer:
+Name:	google.com
+Address: 64.233.178.138
+Name:	google.com
+Address: 64.233.178.101
+Name:	google.com
+Address: 64.233.178.139
+Name:	google.com
+Address: 64.233.178.113
+Name:	google.com
+Address: 64.233.178.102
+Name:	google.com
+Address: 64.233.178.100
+
+[2026-10-12T20:28:38.431Z] [PHASE4-LEAK] External DNS resolution for github.com:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+
+Name:	github.com
+Address: 140.82.112.3
+
+[2026-10-12T20:28:38.594Z] [PHASE4-LEAK] External DNS resolution for cloudflare.com:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+Non-authoritative answer:
+Name:	cloudflare.com
+Address: 104.16.133.229
+Name:	cloudflare.com
+Address: 104.16.132.229
+
+Non-authoritative answer:
+Name:	cloudflare.com
+Address: 2606:4700::6810:84e5
+Name:	cloudflare.com
+Address: 2606:4700::6810:85e5
+
+[2026-10-12T20:28:38.595Z] [PHASE4-LEAK] Testing DNS server handling of non-existent internal domain (leak check)...
+
+[2026-10-12T20:28:38.768Z] [PHASE4-LEAK] Leak test query output:
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+** server can't find leak-test-nonexistent-internal-ghaymah.mesh: NXDOMAIN
+
+** server can't find leak-test-nonexistent-internal-ghaymah.mesh: NXDOMAIN
+
+[2026-10-12T20:28:38.770Z] [DONE] === ALL GHAYMAH PLATFORM TESTS COMPLETED SUCCESSFULLY ===
@@ -0,0 +1,317 @@
+[
+  {
+    "timestamp": "2026-10-12T20:27:02.752Z",
+    "category": "Environment",
+    "testName": "Container Identity",
+    "status": "INFO",
+    "details": "root\nuid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:02.893Z",
+    "category": "Environment",
+    "testName": "Network Interfaces",
+    "status": "INFO",
+    "details": "1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000\n    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1/8 scope host lo\n       valid_lft forever preferred_lft forever\n    inet6 ::1/128 scope host \n       valid_lft forever preferred_lft forever\n2: eth0@if43491: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1250 qdisc noqueue state UP qlen 1000\n    link/ether a6:44:41:9e:20:3b brd ff:ff:ff:ff:ff:ff\n    inet 10.42.5.98/24 brd 10.42.5.255 scope global eth0\n       valid_lft forever preferred_lft forever"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:03.028Z",
+    "category": "Environment",
+    "testName": "Routing Table",
+    "status": "INFO",
+    "details": "default via 10.42.5.1 dev eth0 \n10.42.0.0/16 via 10.42.5.1 dev eth0 \n10.42.5.0/24 dev eth0 scope link  src 10.42.5.98"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:03.192Z",
+    "category": "Environment",
+    "testName": "DNS Configuration",
+    "status": "INFO",
+    "details": "search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net\nnameserver 10.43.0.10\noptions ndots:5"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:03.430Z",
+    "category": "Internal DNS",
+    "testName": "Short Hostname Resolution (test-redis)",
+    "status": "FAIL",
+    "details": {
+      "command": "nslookup test-redis",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find test-redis.svc.cluster.local: NXDOMAIN\n\n** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find test-redis.svc.cluster.local: NXDOMAIN\n\n** server can't find test-redis.cluster.local: NXDOMAIN\n\n** server can't find test-redis.cluster.local: NXDOMAIN\n\n** server can't find test-redis.cs221.mtl2.ca.leaseweb.net: NXDOMAIN\n\n** server can't find test-redis.cs221.mtl2.ca.leaseweb.net: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:03.869Z",
+    "category": "Internal DNS",
+    "testName": "Resolver Lookup (test-redis)",
+    "status": "FAIL",
+    "details": "ping: bad address 'test-redis'"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.086Z",
+    "category": "Internal DNS",
+    "testName": "Kubernetes FQDN Resolution",
+    "status": "FAIL",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find test-redis.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.261Z",
+    "category": "Internal DNS Pattern Check",
+    "testName": "test-redis.mesh",
+    "status": "NXDOMAIN",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.mesh: NXDOMAIN\n\n** server can't find test-redis.mesh: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.422Z",
+    "category": "Internal DNS Pattern Check",
+    "testName": "test-redis.dns-tcp-test.mesh",
+    "status": "NXDOMAIN",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.dns-tcp-test.mesh: NXDOMAIN\n\n** server can't find test-redis.dns-tcp-test.mesh: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.565Z",
+    "category": "Internal DNS Pattern Check",
+    "testName": "test-redis.local",
+    "status": "NXDOMAIN",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.local: NXDOMAIN\n\n** server can't find test-redis.local: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.797Z",
+    "category": "Internal DNS Pattern Check",
+    "testName": "test-redis.internal",
+    "status": "NXDOMAIN",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find test-redis.internal: NXDOMAIN\n\n** server can't find test-redis.internal: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:04.974Z",
+    "category": "TCP Connectivity",
+    "testName": "TCP Port 6379 Probe via DNS Hostname",
+    "status": "FAIL",
+    "details": {
+      "command": "nc -z -w 3 test-redis 6379",
+      "output": "nc: bad address 'test-redis'",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:05.192Z",
+    "category": "TCP Protocol",
+    "testName": "Redis Raw TCP PING/PONG",
+    "status": "FAIL",
+    "details": {
+      "command": "printf \"*1\\r\\n\\$4\\r\\nPING\\r\\n\" | nc -w 3 test-redis 6379",
+      "output": "nc: bad address 'test-redis'",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:15.200Z",
+    "category": "TCP Data Integrity",
+    "testName": "Redis State Storage & Retrieval via Raw TCP",
+    "status": "PASS",
+    "details": {
+      "output": "client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# \r\n\rclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# printf \"*3\\r\\n\\$3\\r\\nSET\\r\\n\\$12\\r\\nghaymah_test\\r\\n\\$11\\r\\nOK_TCP_PASS\\r\\n\" | nc -w 3 test-redis 6379\r\n\rnc: bad address 'test-redis'\r\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# printf \"*2\\r\\n\\$3\\r\\nGET\\r\\n\\$12\\r\\nghaymah_test\\r\\n\" | nc -w 3 test-redis 6379\r\n\rnc: bad address 'test-redis'\r\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# ; echo __RET__$?_ma3g0t__END__\r\n\rbash: syntax error near unexpected token `;'\r\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~#",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:15.438Z",
+    "category": "Isolation",
+    "testName": "Cross-Project DNS: auth-deploy",
+    "status": "BLOCKED (SECURE)",
+    "details": {
+      "target": "auth-deploy",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find auth-deploy.svc.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.svc.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find auth-deploy.cs221.mtl2.ca.leaseweb.net: NXDOMAIN\n\n** server can't find auth-deploy.cs221.mtl2.ca.leaseweb.net: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:15.686Z",
+    "category": "Isolation",
+    "testName": "Cross-Project DNS: auth-deploy.mesh",
+    "status": "BLOCKED (SECURE)",
+    "details": {
+      "target": "auth-deploy.mesh",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find auth-deploy.mesh: NXDOMAIN\n\n** server can't find auth-deploy.mesh: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:15.822Z",
+    "category": "Isolation",
+    "testName": "Cross-Project DNS: auth-deploy.local",
+    "status": "BLOCKED (SECURE)",
+    "details": {
+      "target": "auth-deploy.local",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find auth-deploy.local: NXDOMAIN\n\n** server can't find auth-deploy.local: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.062Z",
+    "category": "Isolation",
+    "testName": "Cross-Project DNS: scanner-clean",
+    "status": "BLOCKED (SECURE)",
+    "details": {
+      "target": "scanner-clean",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find scanner-clean.svc.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.svc.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find scanner-clean.cs221.mtl2.ca.leaseweb.net: NXDOMAIN\n\n** server can't find scanner-clean.cs221.mtl2.ca.leaseweb.net: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.203Z",
+    "category": "Isolation",
+    "testName": "Cross-Project DNS: scanner-clean.mesh",
+    "status": "BLOCKED (SECURE)",
+    "details": {
+      "target": "scanner-clean.mesh",
+      "output": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find scanner-clean.mesh: NXDOMAIN\n\n** server can't find scanner-clean.mesh: NXDOMAIN",
+      "exitCode": 1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.340Z",
+    "category": "Tenant Isolation",
+    "testName": "Cross-Tenant DNS: kubernetes.default.svc",
+    "status": "BLOCKED",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find kubernetes.default.svc: NXDOMAIN\n\n** server can't find kubernetes.default.svc: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.490Z",
+    "category": "Tenant Isolation",
+    "testName": "Cross-Tenant DNS: metadata.google.internal",
+    "status": "BLOCKED",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find metadata.google.internal: NXDOMAIN\n\n** server can't find metadata.google.internal: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.676Z",
+    "category": "Tenant Isolation",
+    "testName": "Cross-Tenant DNS: admin-panel",
+    "status": "BLOCKED",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find admin-panel.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.svc.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.svc.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local: NXDOMAIN\n\n** server can't find admin-panel.cs221.mtl2.ca.leaseweb.net: NXDOMAIN\n\n** server can't find admin-panel.cs221.mtl2.ca.leaseweb.net: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.817Z",
+    "category": "Tenant Isolation",
+    "testName": "Cross-Tenant DNS: backend.internal",
+    "status": "BLOCKED",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find backend.internal: NXDOMAIN\n\n** server can't find backend.internal: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:16.960Z",
+    "category": "Tenant Isolation",
+    "testName": "Cross-Tenant DNS: database.default",
+    "status": "BLOCKED",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find database.default: NXDOMAIN\n\n** server can't find database.default: NXDOMAIN"
+  },
+  {
+    "timestamp": "2026-10-12T20:27:26.975Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 10.43.0.1",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "10.43.0.1",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:36.987Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 10.43.0.10",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "10.43.0.10",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:47.011Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 10.42.5.1",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "10.42.5.1",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:27:57.025Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 10.100.0.1",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "10.100.0.1",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:28:07.031Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 10.100.0.2",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "10.100.0.2",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:28:17.038Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 172.17.0.1",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "172.17.0.1",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:28:27.053Z",
+    "category": "Network Isolation",
+    "testName": "Direct IP Probing: 169.254.169.254",
+    "status": "BLOCKED",
+    "details": {
+      "ip": "169.254.169.254",
+      "exitCode": -1
+    }
+  },
+  {
+    "timestamp": "2026-10-12T20:28:37.063Z",
+    "category": "Network Enumeration",
+    "testName": "Port Scan test-redis",
+    "status": "COMPLETED",
+    "details": "client-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# for p in 22 53 80 443 3000 4000 5432 6379 8080 9000; do\r\n\r>   nc -z -w 1 test-redis $p && echo \"PORT $p OPEN\" || echo \"PORT $p CLOSED\"\r\n\r> done\r\n\rnc: bad address 'test-redis'\r\nPORT 22 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 53 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 80 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 443 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 3000 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 4000 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 5432 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 6379 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 8080 CLOSED\r\nnc: bad address 'test-redis'\r\nPORT 9000 CLOSED\r\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~# ; echo __RET__$?_iwjsdj__END__\r\n\rbash: syntax error near unexpected token `;'\r\nclient-terminal-0f1fe89209a8-v2-58f99dfc8b-rjnlw:~#"
+  },
+  {
+    "timestamp": "2026-10-12T20:28:38.002Z",
+    "category": "Dual Routing",
+    "testName": "Outbound Internet Access (Egress)",
+    "status": "PASS",
+    "details": "{\n  \"origin\": \"184.107.141.203\"\n}"
+  },
+  {
+    "timestamp": "2026-10-12T20:28:38.269Z",
+    "category": "DNS Routing",
+    "testName": "External DNS Resolution (google.com)",
+    "status": "PASS",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\nNon-authoritative answer:\nName:\tgoogle.com\nAddress: 2607:f8b0:4020:c07::66\nName:\tgoogle.com\nAddress: 2607:f8b0:4020:c07::64\nName:\tgoogle.com\nAddress: 2607:f8b0:4020:c07::71\nName:\tgoogle.com\nAddress: 2607:f8b0:4020:c07::8b\n\nNon-authoritative answer:\nName:\tgoogle.com\nAddress: 64.233.178.138\nName:\tgoogle.com\nAddress: 64.233.178.101\nName:\tgoogle.com\nAddress: 64.233.178.139\nName:\tgoogle.com\nAddress: 64.233.178.113\nName:\tgoogle.com\nAddress: 64.233.178.102\nName:\tgoogle.com\nAddress: 64.233.178.100"
+  },
+  {
+    "timestamp": "2026-10-12T20:28:38.432Z",
+    "category": "DNS Routing",
+    "testName": "External DNS Resolution (github.com)",
+    "status": "PASS",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n\nName:\tgithub.com\nAddress: 140.82.112.3"
+  },
+  {
+    "timestamp": "2026-10-12T20:28:38.594Z",
+    "category": "DNS Routing",
+    "testName": "External DNS Resolution (cloudflare.com)",
+    "status": "PASS",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\nNon-authoritative answer:\nName:\tcloudflare.com\nAddress: 104.16.133.229\nName:\tcloudflare.com\nAddress: 104.16.132.229\n\nNon-authoritative answer:\nName:\tcloudflare.com\nAddress: 2606:4700::6810:84e5\nName:\tcloudflare.com\nAddress: 2606:4700::6810:85e5"
+  },
+  {
+    "timestamp": "2026-10-12T20:28:38.769Z",
+    "category": "DNS Leak Detection",
+    "testName": "Non-existent Mesh Domain Query",
+    "status": "SECURE (NXDOMAIN)",
+    "details": "Server:\t\t10.43.0.10\nAddress:\t10.43.0.10:53\n\n** server can't find leak-test-nonexistent-internal-ghaymah.mesh: NXDOMAIN\n\n** server can't find leak-test-nonexistent-internal-ghaymah.mesh: NXDOMAIN"
+  }
+]
@@ -0,0 +1,64 @@
+[2026-10-12T20:28:48.246Z] === DNS: nslookup test-redis-feccbaec5bd7 ===
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+Name:	test-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.5.97
+
+
+** server can't find test-redis-feccbaec5bd7.cluster.local: NXDOMAIN
+
+** server can't find test-redis-feccbaec5bd7.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis-feccbaec5bd7.svc.cluster.local: NXDOMAIN
+
+** server can't find test-redis-feccbaec5bd7.cluster.local: NXDOMAIN
+
+** server can't find test-redis-feccbaec5bd7.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find test-redis-feccbaec5bd7.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:28:48.401Z] === DNS: getent hosts test-redis-feccbaec5bd7 ===
+10.42.5.97        test-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local  test-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local test-redis-feccbaec5bd7
+
+[2026-10-12T20:28:48.576Z] === TCP: nc -z -w 3 test-redis-feccbaec5bd7 6379 ===
+test-redis-feccbaec5bd7 (10.42.5.97:6379) open
+PORT 6379 IS OPEN!
+
+[2026-10-12T20:28:48.721Z] === TCP: PING test-redis-feccbaec5bd7 6379 ===
+PONG
+
+[2026-10-12T20:28:48.960Z] === TCP: Redis SET & GET via DNS ===
+OK
+-ERR unknown command '2'
+-ERR unknown command '$3'
+-ERR wrong number of arguments for 'get' command
+-ERR unknown command '$7'
+-ERR unknown command 'ghaymah'
+
+[2026-10-12T20:28:49.474Z] === SECURITY: Cross-Project DNS (auth-deploy-4c0bca85312b) ===
+Server:		10.43.0.10
+Address:	10.43.0.10:53
+
+
+** server can't find auth-deploy-4c0bca85312b.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy-4c0bca85312b.cluster.local: NXDOMAIN
+
+Name:	auth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local
+Address: 10.42.4.223
+
+** server can't find auth-deploy-4c0bca85312b.svc.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy-4c0bca85312b.cluster.local: NXDOMAIN
+
+** server can't find auth-deploy-4c0bca85312b.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+** server can't find auth-deploy-4c0bca85312b.cs221.mtl2.ca.leaseweb.net: NXDOMAIN
+
+[2026-10-12T20:28:49.678Z] === SECURITY: Cross-Project TCP (auth-deploy-4c0bca85312b:80) ===
+auth-deploy-4c0bca85312b (10.42.4.223:80) open
+OPEN
+
+[2026-10-12T20:28:49.827Z] === SECURITY: Cross-Project HTTP GET ===
+<h1>test</h1>