feat: initial commit of Ghaymah internal DNS, TCP and security testing suite and report

2026-10-12 23:43:09 +03:00
commit bdcd2d44f5
57 changed files with 6499 additions and 0 deletions
@@ -0,0 +1,133 @@
+// Phase 2: API Reconnaissance - Compare Ghaymah vs Cumin endpoints
+const fs = require("fs");
+
+const CUMIN_TOKEN = "cumin_GjynCIFJtyoZ_73wasCoWNYf7Y-Pk0jMffHEdRzblBg";
+const PROJECT_ID = "178bfad9-5edc-409f-833c-6fffca7aed5a";
+
+// Test both the Cumin API and Ghaymah deploy endpoint
+const ENDPOINTS = [
+  { name: "Cumin API", base: "https://api.cumin.dev" },
+  { name: "Ghaymah Deploy", base: "https://deploy.ghaymah.systems" },
+  { name: "Ghaymah API", base: "https://api.ghaymah.systems" },
+];
+
+const log = [];
+function logEntry(msg) {
+  const ts = new Date().toISOString();
+  const entry = `[${ts}] ${msg}`;
+  console.log(entry);
+  log.push(entry);
+}
+
+async function probeEndpoint(name, url, opts = {}) {
+  try {
+    const res = await fetch(url, { signal: AbortSignal.timeout(8000), ...opts });
+    const contentType = res.headers.get("content-type") || "unknown";
+    let body = "";
+    try { body = await res.text(); } catch {}
+    const snippet = body.substring(0, 500);
+    logEntry(`${name} → ${url} → Status: ${res.status} | Content-Type: ${contentType} | Body[0:500]: ${snippet}`);
+    return { status: res.status, contentType, body: snippet };
+  } catch (e) {
+    logEntry(`${name} → ${url} → ERROR: ${e.message}`);
+    return { status: "error", error: e.message };
+  }
+}
+
+async function mcpProbe(base) {
+  const headers = {
+    Authorization: `Bearer ${CUMIN_TOKEN}`,
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  
+  logEntry(`--- MCP Probe on ${base}/mcp ---`);
+  const initBody = {
+    jsonrpc: "2.0", method: "initialize", id: 1,
+    params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "ghaymah-recon", version: "1.0" } }
+  };
+  
+  try {
+    const res = await fetch(`${base}/mcp`, {
+      method: "POST", headers, body: JSON.stringify(initBody),
+      signal: AbortSignal.timeout(10000)
+    });
+    const sid = res.headers.get("Mcp-Session-Id");
+    const data = await res.json();
+    logEntry(`MCP Init → Status: ${res.status} | Session: ${sid} | Response: ${JSON.stringify(data).substring(0, 300)}`);
+    
+    if (sid) {
+      // List available tools
+      headers["Mcp-Session-Id"] = sid;
+      const toolsRes = await fetch(`${base}/mcp`, {
+        method: "POST", headers,
+        body: JSON.stringify({ jsonrpc: "2.0", method: "tools/list", id: 2, params: {} }),
+        signal: AbortSignal.timeout(10000)
+      });
+      const toolsData = await toolsRes.json();
+      const toolNames = toolsData.result?.tools?.map(t => t.name) || [];
+      logEntry(`MCP Tools Available (${toolNames.length}): ${JSON.stringify(toolNames)}`);
+      
+      // List apps 
+      const appsRes = await fetch(`${base}/mcp`, {
+        method: "POST", headers,
+        body: JSON.stringify({ jsonrpc: "2.0", method: "tools/call", id: 3, params: { name: "list_apps", arguments: { project_id: PROJECT_ID } } }),
+        signal: AbortSignal.timeout(10000)
+      });
+      const appsData = await appsRes.json();
+      const appsText = appsData.result?.content?.[0]?.text || JSON.stringify(appsData);
+      logEntry(`MCP list_apps → ${appsText.substring(0, 500)}`);
+      
+      return { sid, toolNames };
+    }
+  } catch (e) {
+    logEntry(`MCP Probe ERROR: ${e.message}`);
+  }
+  return null;
+}
+
+async function main() {
+  logEntry("=== GHAYMAH DNS/NET SECURITY TEST - PHASE 2: API RECONNAISSANCE ===");
+  
+  // 1. Probe basic endpoints
+  for (const ep of ENDPOINTS) {
+    await probeEndpoint(ep.name, ep.base);
+    await probeEndpoint(ep.name, `${ep.base}/health`);
+    await probeEndpoint(ep.name, `${ep.base}/api`);
+  }
+  
+  // 2. Probe Cumin-style REST endpoints on ghaymah
+  logEntry("\n--- Probing Ghaymah for Cumin-compatible REST endpoints ---");
+  const ghaymahApiCandidates = [
+    "https://api.ghaymah.systems/policy/network",
+    "https://deploy.ghaymah.systems/api/apps",
+    "https://deploy.ghaymah.systems/api/projects",
+    "https://api.ghaymah.systems/mcp",
+  ];
+  
+  for (const url of ghaymahApiCandidates) {
+    await probeEndpoint("Ghaymah REST", url, {
+      headers: { Authorization: `Bearer ${CUMIN_TOKEN}` }
+    });
+  }
+  
+  // 3. MCP protocol probe on Cumin (baseline)
+  const cuminMcp = await mcpProbe("https://api.cumin.dev");
+  
+  // 4. Try MCP on Ghaymah
+  const ghaymahMcp = await mcpProbe("https://api.ghaymah.systems");
+  
+  // 5. Check network policy
+  logEntry("\n--- Network Policy Probe ---");
+  const policyRes = await probeEndpoint("Cumin Policy", "https://api.cumin.dev/policy/network", {
+    headers: { Authorization: `Bearer ${CUMIN_TOKEN}` }
+  });
+  
+  logEntry("\n=== RECONNAISSANCE COMPLETE ===");
+  
+  // Write log
+  fs.writeFileSync("d:/cumin/ghaymah_dns_net_sec_tests/logs/01_api_recon.log", log.join("\n"));
+  console.log("\nLog written to logs/01_api_recon.log");
+}
+
+main().catch(e => { logEntry(`FATAL: ${e.message}`); process.exit(1); });