[ { "timestamp": "2026-10-12T20:58:50.448Z", "category": "Reconnaissance", "testName": "OS & Kernel", "target": "soc-tester", "status": "PASS", "notes": "", "output": "Linux soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 Linux\nPRETTY_NAME=\"Alpine Linux v3.24\"" }, { "timestamp": "2026-10-12T20:58:50.588Z", "category": "Reconnaissance", "testName": "IP Interface", "target": "soc-tester", "status": "PASS", "notes": "", "output": "2: eth0@if43495: mtu 1250 qdisc noqueue state UP qlen 1000\n link/ether ba:84:f8:4d:b1:8c brd ff:ff:ff:ff:ff:ff\n inet 10.42.5.102/24 brd 10.42.5.255 scope global eth0\n valid_lft forever preferred_lft forever" }, { "timestamp": "2026-10-12T20:58:50.955Z", "category": "Reconnaissance", "testName": "CoreDNS Config (/etc/resolv.conf)", "target": "CoreDNS", "status": "PASS", "notes": "", "output": "search d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local svc.cluster.local cluster.local cs221.mtl2.ca.leaseweb.net\nnameserver 10.43.0.10\noptions ndots:5" }, { "timestamp": "2026-10-12T20:58:51.854Z", "category": "DNS Functionality", "testName": "Resolve soc-redis", "target": "soc-redis-10f420c389ef", "status": "PASS", "notes": "Resolves redis to internal overlay IP", "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-redis-10f420c389ef.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.99\n;; Got recursion not available from 10.43.0.10" }, { "timestamp": "2026-10-12T20:58:52.756Z", "category": "DNS Functionality", "testName": "Resolve soc-backend", "target": "soc-backend-d1895c70f6b2", "status": "PASS", "notes": "Resolves backend to internal overlay IP", "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-backend-d1895c70f6b2.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.103\n;; Got recursion not available from 10.43.0.10" }, { "timestamp": "2026-10-12T20:58:53.547Z", "category": "DNS Functionality", "testName": "Resolve soc-gateway", "target": "soc-gateway-28cd1dc4e034", "status": "PASS", "notes": "Resolves gateway to internal overlay IP", "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tsoc-gateway-28cd1dc4e034.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.101\n;; Got recursion not available from 10.43.0.10" }, { "timestamp": "2026-10-12T20:59:05.562Z", "category": "DNS Functionality", "testName": "Dig A Record", "target": "soc-redis-10f420c389ef", "status": "PASS", "notes": "", "output": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#" }, { "timestamp": "2026-10-12T20:59:06.278Z", "category": "DNS Functionality", "testName": "Reverse PTR Lookup", "target": "dig +short soc-redis-10f420c389ef; echo __RET__$?_wb05rp__END__\r\n\r__RET__0_wb05rp__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#", "status": "INFO", "notes": "", "output": "bash: soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#: command not found" }, { "timestamp": "2026-10-12T20:59:07.275Z", "category": "DNS Functionality", "testName": "Negative DNS Handling", "target": "non-existent-service-mesh.local", "status": "PASS", "notes": "Expect NXDOMAIN", "output": ";; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\n;; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\n** server can't find non-existent-service-mesh.local: NXDOMAIN" }, { "timestamp": "2026-10-12T20:59:07.461Z", "category": "TCP Functionality", "testName": "TCP Port 6379 Probe", "target": "soc-redis-10f420c389ef:6379", "status": "PASS", "notes": "", "output": "soc-redis-10f420c389ef (10.42.5.99:6379) open" }, { "timestamp": "2026-10-12T20:59:07.600Z", "category": "TCP Functionality", "testName": "Redis PING Handshake", "target": "soc-redis-10f420c389ef:6379", "status": "PASS", "notes": "Expect +PONG", "output": "+PONG" }, { "timestamp": "2026-10-12T20:59:07.955Z", "category": "TCP Functionality", "testName": "Redis SET Security Event", "target": "soc-redis-10f420c389ef:6379", "status": "PASS", "notes": "Expect +OK", "output": "+OK" }, { "timestamp": "2026-10-12T20:59:08.100Z", "category": "TCP Functionality", "testName": "Redis GET Security Event", "target": "soc-redis-10f420c389ef:6379", "status": "PASS", "notes": "Retrieved CRITICAL_RANSOMWARE_BLOCKED_ON_MESH", "output": "$35\nCRITICAL_RANSOMWARE_BLOCKED_ON_MESH" }, { "timestamp": "2026-10-12T20:59:20.105Z", "category": "TCP Functionality", "testName": "Redis INCR Attack Counter", "target": "soc-redis-10f420c389ef:6379", "status": "PASS", "notes": "", "output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# printf \"*2\\r\\n\\$4\\r\\nINCR\\r\\n\\$24\\r\\nsoc:threats:total_count\\r\\n\" | nc -w 3 soc-redis-10f420c389ef 6379; echo __RET__$?_w9pga3__END__\r\n\r__RET__0_w9pga3__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#" }, { "timestamp": "2026-10-12T20:59:20.320Z", "category": "Inter-Service Mesh", "testName": "soc-gateway -> soc-redis (Port 6379)", "target": "soc-gateway-28cd1dc4e034 -> soc-redis-10f420c389ef", "status": "PASS", "notes": "Edge Gateway queries Database over internal mesh", "output": "+PONG" }, { "timestamp": "2026-10-12T20:59:20.532Z", "category": "Inter-Service Mesh", "testName": "soc-gateway -> soc-backend (Port 7681)", "target": "soc-gateway-28cd1dc4e034 -> soc-backend-d1895c70f6b2", "status": "PASS", "notes": "Gateway probes backend over internal mesh", "output": "soc-backend-d1895c70f6b2 (10.42.5.103:7681) open" }, { "timestamp": "2026-10-12T20:59:21.816Z", "category": "Edge Ingress", "testName": "Public Gateway URL", "target": "https://soc-gateway-28cd1dc4e034.hosted.ghaymah.systems/", "status": "PASS", "notes": "", "output": "HTTP Status: 200" }, { "timestamp": "2026-10-12T20:59:22.283Z", "category": "Edge Ingress Isolation", "testName": "Database External Unreachability", "target": "https://soc-redis-10f420c389ef.hosted.ghaymah.systems/", "status": "PASS", "notes": "Private service should not be exposed externally", "output": "Status: 404" }, { "timestamp": "2026-10-12T20:59:22.951Z", "category": "Security / Isolation", "testName": "Cross-Project DNS (test-redis-feccbaec5bd7)", "target": "test-redis-feccbaec5bd7", "status": "FINDING", "notes": "Intra-tenant cross-project DNS allowed", "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\ttest-redis-feccbaec5bd7.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.5.97\n;; Got recursion not available from 10.43.0.10" }, { "timestamp": "2026-10-12T20:59:23.772Z", "category": "Security / Isolation", "testName": "Cross-Project DNS (auth-deploy-4c0bca85312b)", "target": "auth-deploy-4c0bca85312b", "status": "FINDING", "notes": "Intra-tenant cross-project DNS allowed", "output": ";; Got recursion not available from 10.43.0.10\nServer:\t\t10.43.0.10\nAddress:\t10.43.0.10#53\n\nName:\tauth-deploy-4c0bca85312b.d62f9886-fced-4cf2-98e4-5b62000d4f03.svc.cluster.local\nAddress: 10.42.4.223\n;; Got recursion not available from 10.43.0.10" }, { "timestamp": "2026-10-12T20:59:23.953Z", "category": "Security / Isolation", "testName": "Cross-Project TCP Lateral Movement (Redis 6379)", "target": "test-redis-feccbaec5bd7:6379", "status": "FINDING", "notes": "Unrestricted intra-tenant cross-project TCP socket connection allowed", "output": "test-redis-feccbaec5bd7 (10.42.5.97:6379) open" }, { "timestamp": "2026-10-12T20:59:24.101Z", "category": "Security / Isolation", "testName": "Cross-Project HTTP Lateral Movement (Auth-deploy:80)", "target": "auth-deploy-4c0bca85312b:80", "status": "FINDING", "notes": "Cross-project HTTP communication succeeded", "output": "

test

" }, { "timestamp": "2026-10-12T20:59:36.105Z", "category": "Security / Cluster Boundary", "testName": "Kubernetes API Server (10.43.0.1:443)", "target": "10.43.0.1:443", "status": "INFO", "notes": "Checks cluster API access controls", "output": "soc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~# curl -k -s -m 3 https://10.43.0.1:443/version || nc -zv -w 3 10.43.0.1 443 2>&1; echo __RET__$?_cvh4hj__END__\r\n\r{\r\n \"kind\": \"Status\",\r\n \"apiVersion\": \"v1\",\r\n \"metadata\": {},\r\n \"status\": \"Failure\",\r\n \"message\": \"Unauthorized\",\r\n \"reason\": \"Unauthorized\",\r\n \"code\": 401\r\n}__RET__0_cvh4hj__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#" }, { "timestamp": "2026-10-12T20:59:39.348Z", "category": "Security / SSRF Isolation", "testName": "Cloud Metadata Endpoint (169.254.169.254)", "target": "169.254.169.254", "status": "PASS", "notes": "Cloud metadata endpoint unreachable", "output": "BLOCKED_OR_UNREACHABLE" }, { "timestamp": "2026-10-12T20:59:39.662Z", "category": "Security / Cluster Telemetry", "testName": "CoreDNS Metrics (10.43.0.10:9153)", "target": "10.43.0.10:9153", "status": "INFO", "notes": "", "output": "# HELP coredns_build_info A metric with a constant '1' value labeled by version, revision, and goversion from which CoreDNS was built.\n# TYPE coredns_build_info gauge\ncoredns_build_info{goversion=\"go1.24.5\",revision=\"463fd1c\",version=\"1.12.3\"} 1\n# HELP coredns_cache_entries The number of elements in the cache.\n# TYPE coredns_cache_entries gauge" }, { "timestamp": "2026-10-12T20:59:43.260Z", "category": "Security / Network Recon", "testName": "Internal Subnet Port Sweep", "target": "10.42.5.97-103", "status": "PASS", "notes": "Identified active service endpoints on overlay network", "output": "10.42.5.97 (10.42.5.97:6379) open\n10.42.5.98 (10.42.5.98:7681) open\n10.42.5.99 (10.42.5.99:6379) open\n10.42.5.101 (10.42.5.101:7681) open\n10.42.5.102 (10.42.5.102:7681) open\n10.42.5.103 (10.42.5.103:7681) open" }, { "timestamp": "2026-10-12T20:59:43.461Z", "category": "Security / Container Hardening", "testName": "Privilege & Capabilities", "target": "soc-tester", "status": "INFO", "notes": "", "output": "CapInh:\t0000000000000000\nCapPrm:\t00000000a80425fb\nCapEff:\t00000000a80425fb\nCapBnd:\t00000000a80425fb\nCapAmb:\t0000000000000000\nroot" }, { "timestamp": "2026-10-12T20:59:55.470Z", "category": "Network / Egress NAT", "testName": "Outbound Public IP", "target": "api.ipify.org", "status": "PASS", "notes": "Cluster node egress NAT IP", "output": "# curl -s -m 4 https://api.ipify.org || wget -qO- -T 4 https://api.ipify.org; echo __RET__$?_3ufsoz__END__\r\n\r184.107.141.203__RET__0_3ufsoz__END__\r\nsoc-tester-9b6540e2d4ed-v2-7db576fdc5-k8mb6:~#" } ]