# Ghaymah Systems — Private Networking & Internal DNS Testing Suite

Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).

## 📋 Full Assessment Report
Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures:
👉 **[GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**

---

## 🎯 Scope & Objectives
1. **Internal DNS Verification**: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS `10.43.0.10:53`) using deterministic uniqueName identifiers (`[app-name]-[hash]`).
2. **Raw TCP Connectivity**: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (`test-redis` on port 6379).
3. **Security & Penetration Testing**:
   - Cross-project lateral movement assessment within the same tenant.
   - Cross-tenant and cluster infrastructure isolation verification.
   - Network enumeration and port scanning.
   - Dual routing and DNS leak detection.

---

## 📂 Directory Structure

```text
├── reports/
│   └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md   # Final assessment report
├── logs/
│   ├── ghaymah_execution.log                    # Complete end-to-end execution log
│   ├── uniquename_dns_tcp.log                   # Targeted uniqueName resolution & TCP test log
│   ├── ghaymah_test_results.json                # Structured test results
│   ├── 01_api_recon.md                          # Phase 2 API discovery
│   └── 02_mcp_discovery.md                      # MCP tools discovery
├── scripts/
│   ├── run_comprehensive_ghaymah_tests.js       # End-to-end automated test runner
│   ├── test_uniquename_dns_tcp.js               # Targeted DNS & TCP verification script
│   ├── remote_exec.js                           # WebSocket terminal execution client
│   ├── deploy_redis.js                          # Deploys private Redis container
│   ├── deploy_terminal.js                       # Deploys diagnostic terminal container
│   ├── build_and_deploy_apps.js                 # Artifact build & deployment pipeline
│   └── auth_manager.js                          # Token management & caching
└── sample_artifact.tar.gz                       # Reference Ghaymah build artifact
```

---

## 📊 Summary of Findings

| Test Area | Target | Status | Notes |
| :--- | :--- | :---: | :--- |
| **Internal DNS** | `test-redis-feccbaec5bd7` | **PASS** | Resolves to `10.42.5.97` via CoreDNS |
| **Raw TCP** | `test-redis:6379` | **PASS** | `PING` $\rightarrow$ `+PONG`, `SET` $\rightarrow$ `+OK` |
| **Tenant Isolation** | Cluster infrastructure / External tenants | **PASS** | `NXDOMAIN` / Timeouts for non-tenant resources |
| **Project Isolation** | `auth-deploy-4c0bca85312b` (Separate project) | **FINDING** | **MEDIUM/HIGH**: Intra-tenant cross-project traffic allowed |
| **Internet Egress** | `httpbin.org/ip` | **PASS** | NAT Gateway active (`184.107.141.203`) |
| **DNS Leaks** | Upstream resolver | **PASS** | No leakage of internal/mesh queries |

---

## 🚀 Reproduction & Execution

To execute the tests against the live Ghaymah deployment:

```bash
# 1. Run targeted uniqueName verification
node scripts/test_uniquename_dns_tcp.js

# 2. Run full test suite
node scripts/run_comprehensive_ghaymah_tests.js
```