70 lines
3.4 KiB
Markdown
70 lines
3.4 KiB
Markdown
# Ghaymah Systems — Private Networking & Internal DNS Testing Suite
|
|
|
|
Comprehensive Automated QA, Internal DNS, Raw TCP, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
|
|
|
|
## 📋 Full Assessment Report
|
|
Read the full report with architecture diagrams, raw evidence, and vulnerability disclosures:
|
|
👉 **[GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md](reports/GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md)**
|
|
|
|
---
|
|
|
|
## 🎯 Scope & Objectives
|
|
1. **Internal DNS Verification**: Prove discovery and communication between containers within the same project relying on DNS resolution (CoreDNS `10.43.0.10:53`) using deterministic uniqueName identifiers (`[app-name]-[hash]`).
|
|
2. **Raw TCP Connectivity**: Verify non-HTTP raw TCP socket communication over private network using a deployed Redis instance (`test-redis` on port 6379).
|
|
3. **Security & Penetration Testing**:
|
|
- Cross-project lateral movement assessment within the same tenant.
|
|
- Cross-tenant and cluster infrastructure isolation verification.
|
|
- Network enumeration and port scanning.
|
|
- Dual routing and DNS leak detection.
|
|
|
|
---
|
|
|
|
## 📂 Directory Structure
|
|
|
|
```text
|
|
├── reports/
|
|
│ └── GHAYMAH_INTERNAL_DNS_NET_SEC_REPORT.md # Final assessment report
|
|
├── logs/
|
|
│ ├── ghaymah_execution.log # Complete end-to-end execution log
|
|
│ ├── uniquename_dns_tcp.log # Targeted uniqueName resolution & TCP test log
|
|
│ ├── ghaymah_test_results.json # Structured test results
|
|
│ ├── 01_api_recon.md # Phase 2 API discovery
|
|
│ └── 02_mcp_discovery.md # MCP tools discovery
|
|
├── scripts/
|
|
│ ├── run_comprehensive_ghaymah_tests.js # End-to-end automated test runner
|
|
│ ├── test_uniquename_dns_tcp.js # Targeted DNS & TCP verification script
|
|
│ ├── remote_exec.js # WebSocket terminal execution client
|
|
│ ├── deploy_redis.js # Deploys private Redis container
|
|
│ ├── deploy_terminal.js # Deploys diagnostic terminal container
|
|
│ ├── build_and_deploy_apps.js # Artifact build & deployment pipeline
|
|
│ └── auth_manager.js # Token management & caching
|
|
└── sample_artifact.tar.gz # Reference Ghaymah build artifact
|
|
```
|
|
|
|
---
|
|
|
|
## 📊 Summary of Findings
|
|
|
|
| Test Area | Target | Status | Notes |
|
|
| :--- | :--- | :---: | :--- |
|
|
| **Internal DNS** | `test-redis-feccbaec5bd7` | **PASS** | Resolves to `10.42.5.97` via CoreDNS |
|
|
| **Raw TCP** | `test-redis:6379` | **PASS** | `PING` $\rightarrow$ `+PONG`, `SET` $\rightarrow$ `+OK` |
|
|
| **Tenant Isolation** | Cluster infrastructure / External tenants | **PASS** | `NXDOMAIN` / Timeouts for non-tenant resources |
|
|
| **Project Isolation** | `auth-deploy-4c0bca85312b` (Separate project) | **FINDING** | **MEDIUM/HIGH**: Intra-tenant cross-project traffic allowed |
|
|
| **Internet Egress** | `httpbin.org/ip` | **PASS** | NAT Gateway active (`184.107.141.203`) |
|
|
| **DNS Leaks** | Upstream resolver | **PASS** | No leakage of internal/mesh queries |
|
|
|
|
---
|
|
|
|
## 🚀 Reproduction & Execution
|
|
|
|
To execute the tests against the live Ghaymah deployment:
|
|
|
|
```bash
|
|
# 1. Run targeted uniqueName verification
|
|
node scripts/test_uniquename_dns_tcp.js
|
|
|
|
# 2. Run full test suite
|
|
node scripts/run_comprehensive_ghaymah_tests.js
|
|
```
|