Ghaymah Systems — Private Networking & Internal DNS Testing Suite

Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for Ghaymah Systems (deploy.ghaymah.systems).

📋 Full Assessment Report

Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures: 👉 GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md

🎯 Scope & Objectives

Internal DNS Verification: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS 10.43.0.10:53) using deterministic uniqueName identifiers ([app-name]-[hash]).
Raw TCP Connectivity: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (test-redis on port 6379).
Security & Penetration Testing:
- Cross-project lateral movement assessment within the same tenant.
- Cross-tenant and cluster infrastructure isolation verification.
- Network enumeration and port scanning.
- Dual routing and DNS leak detection.

📂 Directory Structure

├── reports/
│   └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md   # Final assessment report
├── logs/
│   ├── ghaymah_execution.log                    # Complete end-to-end execution log
│   ├── uniquename_dns_tcp.log                   # Targeted uniqueName resolution & TCP test log
│   ├── ghaymah_test_results.json                # Structured test results
│   ├── 01_api_recon.md                          # Phase 2 API discovery
│   └── 02_mcp_discovery.md                      # MCP tools discovery
├── scripts/
│   ├── run_comprehensive_ghaymah_tests.js       # End-to-end automated test runner
│   ├── test_uniquename_dns_tcp.js               # Targeted DNS & TCP verification script
│   ├── remote_exec.js                           # WebSocket terminal execution client
│   ├── deploy_redis.js                          # Deploys private Redis container
│   ├── deploy_terminal.js                       # Deploys diagnostic terminal container
│   ├── build_and_deploy_apps.js                 # Artifact build & deployment pipeline
│   └── auth_manager.js                          # Token management & caching
└── sample_artifact.tar.gz                       # Reference Ghaymah build artifact

📊 Summary of Findings

Test Area	Target	Status	Notes
Internal DNS	`test-redis-feccbaec5bd7`	PASS	Resolves to `10.42.5.97` via CoreDNS
Raw TCP	`test-redis:6379`	PASS	`PING` `\rightarrow` `+PONG`, `SET` `\rightarrow` `+OK`
Tenant Isolation	Cluster infrastructure / External tenants	PASS	`NXDOMAIN` / Timeouts for non-tenant resources
Project Isolation	`auth-deploy-4c0bca85312b` (Separate project)	FINDING	MEDIUM/HIGH: Intra-tenant cross-project traffic allowed
Internet Egress	`httpbin.org/ip`	PASS	NAT Gateway active (`184.107.141.203`)
DNS Leaks	Upstream resolver	PASS	No leakage of internal/mesh queries

🚀 Reproduction & Execution

To execute the tests against the live Ghaymah deployment:

# 1. Run targeted uniqueName verification
node scripts/test_uniquename_dns_tcp.js

# 2. Run full test suite
node scripts/run_comprehensive_ghaymah_tests.js

3.4 KiB Raw Blame History