165 lines
7.8 KiB
Plaintext
165 lines
7.8 KiB
Plaintext
[2026-10-12T18:52:32.149Z] === PHASE 4: SECURITY & PENETRATION TESTING ===
|
|
|
|
[2026-10-12T18:52:33.765Z] ✅ MCP Connected
|
|
|
|
[2026-10-12T18:52:34.586Z] Deployed apps:
|
|
[2026-10-12T18:52:34.587Z] soc-gateway (0db0f9b0) - Healthy - tags: {"component":"gateway","platform":"soc"}
|
|
[2026-10-12T18:52:34.587Z] dns-test-server (74401df6) - Healthy - tags: {"platform":"soc","role":"dns-test","tier":"backend"}
|
|
[2026-10-12T18:52:34.587Z] dns-test-client (8029db40) - Healthy - tags: {"platform":"soc","role":"dns-test","tier":"frontend"}
|
|
[2026-10-12T18:52:34.587Z] soc-backend (d1309ed4) - Healthy - tags: {"component":"backend","platform":"soc"}
|
|
[2026-10-12T18:52:34.587Z]
|
|
Using soc-backend (d1309ed4-9442-4623-adde-0419c99c8d70) as pen-test host
|
|
|
|
[2026-10-12T18:52:34.587Z] === TEST 1: ISOLATION & LATERAL MOVEMENT ===
|
|
[2026-10-12T18:52:34.587Z] Objective: Attempt to reach apps in DIFFERENT projects or with DIFFERENT tags
|
|
|
|
[2026-10-12T18:52:34.587Z] --- 1a. Lateral Movement via Direct IP Probing ---
|
|
[2026-10-12T18:52:37.954Z] 10.100.0.1 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:41.374Z] 10.100.0.2 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:44.766Z] 10.100.0.10 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:48.154Z] 10.100.0.50 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:51.545Z] 10.100.0.200 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:54.951Z] 10.100.0.254 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:52:58.402Z] 10.100.1.1 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:53:01.757Z] 172.17.0.1 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:53:05.152Z] 172.26.64.1 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:53:08.460Z] 192.168.1.1 → wget: download timed out
|
|
BLOCKED
|
|
[2026-10-12T18:53:08.460Z]
|
|
--- 1b. Cross-Tenant DNS Resolution Attempts ---
|
|
[2026-10-12T18:53:08.863Z] DNS other-project-app → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find other-project-app.mesh: NXDOMAIN
|
|
[2026-10-12T18:53:09.352Z] DNS admin-panel → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find admin-panel.mesh: NXDOMAIN
|
|
[2026-10-12T18:53:09.856Z] DNS database.default → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find database.default: NXDOMAIN
|
|
[2026-10-12T18:53:10.355Z] DNS kubernetes.default.svc → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find kubernetes.default.svc: NXDOMAIN
|
|
[2026-10-12T18:53:10.785Z] DNS metadata.google.internal → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find metadata.google.internal: NXDOMAIN
|
|
[2026-10-12T18:53:11.193Z] DNS 169.254.169.254 → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find 254.169.254.169.in-addr.arpa: NXDOMAIN
|
|
[2026-10-12T18:53:11.663Z] DNS consul.service.consul → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find consul.service.consul: NXDOMAIN
|
|
[2026-10-12T18:53:12.162Z] DNS nomad.service.consul → Server: 127.0.0.1
|
|
Address: 127.0.0.1:53
|
|
|
|
** server can't find nomad.service.consul: NXDOMAIN
|
|
[2026-10-12T18:53:12.162Z]
|
|
--- 1c. Cloud Metadata Service Access Attempt ---
|
|
[2026-10-12T18:53:15.558Z] Metadata http://169.254.169.254/latest/meta-data/... → wget: download timed out
|
|
[2026-10-12T18:53:18.874Z] Metadata http://169.254.169.254/metadata/instance... → wget: download timed out
|
|
[2026-10-12T18:53:19.378Z] Metadata http://metadata.google.internal/computeM... → wget: bad address 'metadata.google.internal'
|
|
[2026-10-12T18:53:22.760Z] Metadata http://100.100.100.200/latest/meta-data/... → wget: download timed out
|
|
[2026-10-12T18:53:22.760Z]
|
|
=== TEST 2: NETWORK ENUMERATION ===
|
|
[2026-10-12T18:53:22.760Z] Objective: Scan for unintended open ports on internal network
|
|
|
|
[2026-10-12T18:53:23.254Z] Our WireGuard IP: 10.100.2.93
|
|
[2026-10-12T18:53:23.254Z]
|
|
--- 2a. Port Scan on 10.100.0.1 (Mesh Gateway) ---
|
|
[2026-10-12T18:53:25.652Z] 10.100.0.1:22 → CLOSED
|
|
[2026-10-12T18:53:27.957Z] 10.100.0.1:53 → CLOSED
|
|
[2026-10-12T18:53:30.454Z] 10.100.0.1:80 → CLOSED
|
|
[2026-10-12T18:53:32.815Z] 10.100.0.1:443 → CLOSED
|
|
[2026-10-12T18:53:35.159Z] 10.100.0.1:3000 → CLOSED
|
|
[2026-10-12T18:53:37.551Z] 10.100.0.1:4000 → CLOSED
|
|
[2026-10-12T18:53:39.952Z] 10.100.0.1:5432 → CLOSED
|
|
[2026-10-12T18:53:42.351Z] 10.100.0.1:6379 → CLOSED
|
|
[2026-10-12T18:53:44.760Z] 10.100.0.1:8080 → CLOSED
|
|
[2026-10-12T18:53:47.129Z] 10.100.0.1:8443 → CLOSED
|
|
[2026-10-12T18:53:49.465Z] 10.100.0.1:9000 → CLOSED
|
|
[2026-10-12T18:53:51.851Z] 10.100.0.1:9090 → CLOSED
|
|
[2026-10-12T18:53:54.251Z] 10.100.0.1:27017 → CLOSED
|
|
[2026-10-12T18:53:54.751Z]
|
|
--- 2b. Port Scan on 10.100.2.134 (soc-gateway) ---
|
|
[2026-10-12T18:53:57.088Z] 10.100.2.134:22 → CLOSED
|
|
[2026-10-12T18:53:59.478Z] 10.100.2.134:53 → CLOSED
|
|
[2026-10-12T18:54:01.846Z] 10.100.2.134:80 → CLOSED
|
|
[2026-10-12T18:54:04.263Z] 10.100.2.134:443 → CLOSED
|
|
[2026-10-12T18:54:04.731Z] 10.100.2.134:3000 → OPEN
|
|
[2026-10-12T18:54:07.102Z] 10.100.2.134:4000 → CLOSED
|
|
[2026-10-12T18:54:09.457Z] 10.100.2.134:5432 → CLOSED
|
|
[2026-10-12T18:54:11.853Z] 10.100.2.134:6379 → CLOSED
|
|
[2026-10-12T18:54:14.218Z] 10.100.2.134:8080 → CLOSED
|
|
[2026-10-12T18:54:16.557Z] 10.100.2.134:8443 → CLOSED
|
|
[2026-10-12T18:54:18.987Z] 10.100.2.134:9000 → CLOSED
|
|
[2026-10-12T18:54:21.424Z] 10.100.2.134:9090 → CLOSED
|
|
[2026-10-12T18:54:23.737Z] 10.100.2.134:27017 → CLOSED
|
|
[2026-10-12T18:54:23.737Z]
|
|
--- 2c. Self Port Scan (localhost) ---
|
|
[2026-10-12T18:54:24.150Z] 127.0.0.1:22 → CLOSED
|
|
[2026-10-12T18:54:24.653Z] 127.0.0.1:53 → OPEN
|
|
[2026-10-12T18:54:25.079Z] 127.0.0.1:80 → CLOSED
|
|
[2026-10-12T18:54:25.464Z] 127.0.0.1:443 → CLOSED
|
|
[2026-10-12T18:54:25.890Z] 127.0.0.1:3000 → CLOSED
|
|
[2026-10-12T18:54:26.261Z] 127.0.0.1:4000 → OPEN
|
|
[2026-10-12T18:54:26.769Z] 127.0.0.1:5432 → CLOSED
|
|
[2026-10-12T18:54:27.264Z] 127.0.0.1:6379 → CLOSED
|
|
[2026-10-12T18:54:27.782Z] 127.0.0.1:8080 → CLOSED
|
|
[2026-10-12T18:54:28.250Z] 127.0.0.1:9000 → CLOSED
|
|
[2026-10-12T18:54:28.661Z] 127.0.0.1:9090 → CLOSED
|
|
[2026-10-12T18:54:28.661Z]
|
|
=== TEST 3: DUAL ROUTING & DNS LEAK DETECTION ===
|
|
[2026-10-12T18:54:28.661Z] Objective: Verify external internet works AND internal DNS doesn't leak
|
|
|
|
[2026-10-12T18:54:28.661Z] --- 3a. External Internet Connectivity ---
|
|
[2026-10-12T18:54:29.357Z] https://www.google.com → <!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en-CA"><head><meta cont
|
|
[2026-10-12T18:54:30.161Z] https://api.github.com → {"current_user_url":"https://api.github.com/user","current_user_authorizations_html_url":"https://gi
|
|
[2026-10-12T18:54:30.643Z] https://1.1.1.1/dns-query → wget: server returned error: HTTP/1.1 400 Bad Request
|
|
[2026-10-12T18:54:30.643Z]
|
|
--- 3b. DNS Leak Detection ---
|
|
[2026-10-12T18:54:31.055Z] resolv.conf → nameserver 127.0.0.1
|
|
search mesh
|
|
[2026-10-12T18:54:31.502Z] External DNS (8.8.8.8) query → Server: 8.8.8.8
|
|
Address: 8.8.8.8:53
|
|
|
|
** server can't find dns-test-server: NXDOMAIN
|
|
[2026-10-12T18:54:31.958Z] Google DNS leak test → Server: ns1.google.com
|
|
Address: 216.239.32.10:53
|
|
|
|
o-o.myaddr.l.google.com text = "69.157.244.191"
|
|
[2026-10-12T18:54:31.958Z]
|
|
--- 3c. Routing Table ---
|
|
[2026-10-12T18:54:32.508Z] Routes: default via 172.26.64.1 dev eth0
|
|
10.100.0.0/20 dev wg0 scope link
|
|
172.26.64.0/20 dev eth0 scope link
|
|
local 10.100.2.93 dev wg0 scope host
|
|
broadcast 10.100.15.255 dev wg0 scope link
|
|
local 127.0.0.0/8 dev lo scope host
|
|
local 127.0.0.1 dev lo scope host
|
|
broadcast 127.255.255.255 dev lo scope link
|
|
local 172.26.64.26 dev eth0 scope host
|
|
broadcast 172.26.79.255 dev eth0 scope link
|
|
fe80::/64 dev eth0
|
|
local ::1 dev lo
|
|
local fe80::a8cc:e4ff:fe88:d148 dev eth0
|
|
multicast ff00::/8 dev eth0
|
|
[2026-10-12T18:54:32.508Z]
|
|
--- 3d. Firewall Rules ---
|
|
[2026-10-12T18:54:32.951Z] iptables: sh: iptables: not found
|
|
[2026-10-12T18:54:32.951Z]
|
|
=== PHASE 4 COMPLETE === |