Forem: Purushotam Adhikari

Created with ❤️ and zero caffeine.

find node_modules -name "plain-crypto-js" -type d

grep -E "1.14.1|0.30.4" package-lock.json

"dependencies": {
  "axios": "1.14.0"
}

npm cache clean --force

<iframe src="https://playground.wordpress.net/"></iframe>

import { startPlaygroundWeb } from '@wp-playground/client';

const client = await startPlaygroundWeb({
  iframe: document.getElementById('wp-playground'),
  remoteUrl: 'https://playground.wordpress.net/remote.html',
});

await client.installPlugin(pluginZipFile);
await client.installTheme(themeZipFile);

/bin    # ls, cp, ps — essential executables
/sbin   # init, shutdown — system executables
/etc    # config files for system services
/lib    # libraries used by executables
/usr    # user apps, utilities, docs
/var    # logs, spool files, temp files
/root   # home directory of root user

Docker CLI (docker)           ← you type commands here
    │  sends API requests to
    ▼
Docker Daemon (dockerd)       ← the core service
    ├── manages → Images
    ├── manages → Containers
    ├── manages → Networks
    └── manages → Volumes
    │  communicates with
    ▼
Docker Registry (DockerHub / Quay.io / private)

Dockerfile  ──docker build──▶  Image  ──docker run──▶  Container
                                  │
                            docker push
                                  │
                                  ▼
                              Registry

sudo apt update
sudo apt install docker.io -y

# Check daemon status
sudo systemctl status docker

# Start daemon if not running
sudo systemctl start docker

# Add your user to the docker group (replace 'ubuntu' with your username)
sudo usermod -aG docker ubuntu

docker run hello-world

git clone https://github.com/iam-veeramalla/Docker-Zero-to-Hero
cd examples

docker login
# Enter your DockerHub username and password when prompted

docker build -t yourusername/my-first-docker-image:latest .

Successfully built 960d37536dcd
Successfully tagged yourusername/my-first-docker-image:latest

docker images

REPOSITORY                            TAG       IMAGE ID       CREATED          SIZE
yourusername/my-first-docker-image    latest    960d37536dcd   26 seconds ago   467MB
ubuntu                                latest    58db3edaf2be   13 days ago      77.8MB
hello-world                           latest    feb5d9fea6a5   16 months ago    13.3kB

docker run -it yourusername/my-first-docker-image

Hello World

docker push yourusername/my-first-docker-image

sudo systemctl status ssh

sudo apt update
sudo apt install libpam-google-authenticator

google-authenticator

sudo nano /etc/pam.d/sshd

auth required pam_google_authenticator.so

auth required pam_google_authenticator.so nullok

sudo nano /etc/ssh/sshd_config

ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods password,keyboard-interactive

ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive

sudo systemctl restart ssh

ssh username@your-server-ip

Password: 
Verification code: 

sudo timedatectl set-ntp true

sudo apt update
sudo apt install nmap

sudo yum install nmap
# or on newer versions
sudo dnf install nmap

brew install nmap

Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-15 10:30 UTC
Nmap scan report for example.com (192.168.1.100)
Host is up (0.0052s latency).
PORT     STATE    SERVICE    VERSION
22/tcp   open     ssh        OpenSSH 8.9p1
80/tcp   open     http       Apache httpd 2.4.41
443/tcp  open     ssl/http   Apache httpd 2.4.41
8080/tcp filtered http-proxy
MAC Address: 00:1B:44:11:3A:B7 (Dell Inc.)

# Basic ping sweep
nmap -sn 192.168.1.0/24

# ICMP echo, timestamp, and netmask requests
nmap -PE -PP -PM 192.168.1.0/24

# Disable ping (useful when ICMP is blocked)
nmap -Pn 192.168.1.100

# TCP SYN ping to common ports
nmap -PS22,80,443 192.168.1.0/24

# TCP ACK ping
nmap -PA22,80,443 192.168.1.0/24

# TCP connect ping
nmap -PT22,80,443 192.168.1.0/24

# UDP ping to common ports
nmap -PU53,161,137 192.168.1.0/24

# ARP ping (works only on local network)
nmap -PR 192.168.1.0/24

# List scan (no port scan, just list targets)
nmap -sL 192.168.1.0/24

# Comprehensive host discovery
nmap -PE -PP -PS21,22,23,25,53,80,139,443,993,995 \
     -PA80,113,443,10042 -PU53,137,161,500 \
     --source-port 53 192.168.1.0/24

# Default scan type (requires root privileges)
nmap -sS 192.168.1.100

# Specific ports
nmap -sS -p 22,80,443 192.168.1.100

# Port ranges
nmap -sS -p 1-1000 192.168.1.100

# Full TCP connection (doesn't require root)
nmap -sT 192.168.1.100

# Faster but noisier than SYN scan
nmap -sT -p 1-65535 192.168.1.100

# Firewall/IDS evasion and mapping
nmap -sA 192.168.1.100

# Useful for determining firewall rules
nmap -sA -p 80,443 192.168.1.0/24

# Similar to ACK scan but examines window size
nmap -sW 192.168.1.100

# Sends FIN/ACK packets
nmap -sM 192.168.1.100

# Basic UDP scan
nmap -sU 192.168.1.100

# Top UDP ports only
nmap -sU --top-ports 100 192.168.1.100

# Combine with TCP scanning
nmap -sS -sU 192.168.1.100

# Stealthier than SYN scan
nmap -sF 192.168.1.100

# No flags set
nmap -sN 192.168.1.100

# FIN, PSH, and URG flags set
nmap -sX 192.168.1.100

# Uses a zombie host to scan target
nmap -sI zombie_host:port target_host

# Specific ports
nmap -p 22,80,443,8080 192.168.1.100

# Port ranges
nmap -p 1-1000 192.168.1.100

# All ports
nmap -p- 192.168.1.100

# Top ports (most common)
nmap --top-ports 100 192.168.1.100

# Exclude specific ports
nmap -p 1-1000 --exclude-ports 25,135 192.168.1.100

# Protocol-specific ports
nmap -p T:80,443,U:53,161 192.168.1.100

# Enable service detection
nmap -sV 192.168.1.100

# Increase intensity (0-9, default is 7)
nmap -sV --version-intensity 9 192.168.1.100

# Light service detection (faster)
nmap -sV --version-intensity 0 192.168.1.100

# Version detection with scripts
nmap -sC -sV 192.168.1.100

# All aggressive options (OS detection, version detection, script scanning, traceroute)
nmap -A 192.168.1.100

# Custom version detection probes
nmap -sV --version-all 192.168.1.100

# HTTP service enumeration
nmap -p 80,443 --script http-enum 192.168.1.100

# HTTP headers and server information
nmap -p 80 --script http-headers,http-server-header 192.168.1.100

# SSL/TLS information
nmap -p 443 --script ssl-enum-ciphers 192.168.1.100

# SSH algorithm and version enumeration
nmap -p 22 --script ssh2-enum-algos 192.168.1.100

# SSH host key information
nmap -p 22 --script ssh-hostkey 192.168.1.100

# SMB enumeration
nmap -p 139,445 --script smb-enum-shares,smb-enum-users 192.168.1.100

# NetBIOS information
nmap -p 137-139 --script nbstat 192.168.1.100

# DNS enumeration
nmap -p 53 --script dns-zone-transfer 192.168.1.100

# DNS cache snooping
nmap -p 53 --script dns-cache-snoop 192.168.1.100

# Enable OS detection
nmap -O 192.168.1.100

# Aggressive OS detection
nmap -O --osscan-guess 192.168.1.100

# OS detection with version scanning
nmap -O -sV 192.168.1.100

# Maximum OS detection attempts
nmap -O --max-os-tries 5 192.168.1.100

# OS detection against specific ports
nmap -O --osscan-limit 192.168.1.100

# Fuzzy OS matching
nmap -O --fuzzy 192.168.1.100

Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

# Run default scripts
nmap -sC 192.168.1.100

# Run specific script
nmap --script http-enum 192.168.1.100

# Run scripts by category
nmap --script vuln 192.168.1.100

# Run multiple scripts
nmap --script "http-* and not http-brute" 192.168.1.100

# Script with arguments
nmap --script http-enum --script-args http-enum.basepath='/admin/' 192.168.1.100

# Multiple script arguments
nmap --script smb-enum-shares --script-args smbusername=admin,smbpassword=password 192.168.1.100

# Script debugging
nmap --script http-enum --script-trace 192.168.1.100

# Comprehensive vulnerability scan
nmap --script vuln 192.168.1.100

# Specific vulnerability checks
nmap --script ms17-010 192.168.1.100

# SQL injection detection
nmap --script http-sql-injection 192.168.1.100

# SSL/TLS vulnerabilities
nmap --script ssl-heartbleed,ssl-poodle,ssl-ccs-injection 192.168.1.100

-- Example NSE script
local nmap = require "nmap"
local shortport = require "shortport"
local http = require "http"

description = [[
Example HTTP service detection script.
]]

author = "Your Name"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"safe", "discovery"}

portrule = shortport.http
action = function(host, port)
    local response = http.get(host, port, "/")
    if response.status == 200 then
        return "HTTP service detected"
    end
    return nil
end

# Timing templates (0-5, 0 is slowest/stealthiest)
nmap -T0 192.168.1.100  # Paranoid
nmap -T1 192.168.1.100  # Sneaky
nmap -T2 192.168.1.100  # Polite
nmap -T3 192.168.1.100  # Normal (default)
nmap -T4 192.168.1.100  # Aggressive
nmap -T5 192.168.1.100  # Insane

# Custom timing
nmap --scan-delay 5s 192.168.1.100
nmap --max-scan-delay 10s 192.168.1.100
nmap --min-rate 100 192.168.1.100
nmap --max-rate 1000 192.168.1.100

# Fragment packets
nmap -f 192.168.1.100

# Double fragmentation
nmap -ff 192.168.1.100

# Custom MTU (must be multiple of 8)
nmap --mtu 16 192.168.1.100

# Decoy scanning
nmap -D RND:10 192.168.1.100
nmap -D decoy1,decoy2,ME,decoy3 192.168.1.100

# Spoof source IP
nmap -S spoof_ip 192.168.1.100

# Source port specification
nmap --source-port 53 192.168.1.100
nmap -g 80 192.168.1.100

# Randomize source port
nmap --randomize-hosts 192.168.1.0/24

# Send bad checksums
nmap --badsum 192.168.1.100

# Custom data in packets
nmap --data 0xdeadbeef 192.168.1.100

# Custom packet length
nmap --data-length 100 192.168.1.100

# IPv6 scanning for firewall bypass
nmap -6 2001:db8::1

# Proxychains integration
proxychains nmap -sT 192.168.1.100

# Traceroute during scanning
nmap -sS --traceroute 192.168.1.100

# Reverse DNS resolution
nmap -sL 192.168.1.0/24

# DNS resolution control
nmap -n 192.168.1.100  # No DNS resolution
nmap -R 192.168.1.100  # Force DNS resolution

# Efficient large network scanning
nmap -sS -T4 --min-hostgroup 50 --min-parallelism 50 \
     --host-timeout 5m --max-rtt-timeout 2s \
     --initial-rtt-timeout 500ms --max-retries 3 \
     --top-ports 1000 192.168.0.0/16

# Distributed scanning approach
nmap -sS --randomize-hosts -oA scan_batch_1 \
     192.168.1.1-50
nmap -sS --randomize-hosts -oA scan_batch_2 \
     192.168.1.51-100

nmap -p 80,443,8080,8443 \
     --script "http-* and not http-brute and not http-slowloris*" \
     --script-args http.useragent="Mozilla/5.0 (compatible)" \
     192.168.1.0/24

nmap -p 1433,3306,5432,1521,27017 \
     --script "mysql-*,ms-sql-*,oracle-*,pgsql-*,mongodb-*" \
     192.168.1.0/24

nmap -p 25,110,143,993,995 \
     --script "smtp-*,pop3-*,imap-*" \
     192.168.1.0/24

# Normal output (default)
nmap -oN scan_results.txt 192.168.1.100

# XML output
nmap -oX scan_results.xml 192.168.1.100

# Grepable output
nmap -oG scan_results.gnmap 192.168.1.100

# All formats
nmap -oA scan_results 192.168.1.100

# Verbose output
nmap -v 192.168.1.100

# Extra verbose
nmap -vv 192.168.1.100

# Debugging output
nmap -d 192.168.1.100

# Packet trace
nmap --packet-trace 192.168.1.100

# Append to existing file
nmap --append-output -oN existing_file.txt 192.168.1.100

# Using xsltproc
xsltproc scan_results.xml > scan_results.html

# Using Nmap's built-in XSL
xsltproc /usr/share/nmap/nmap.xsl scan_results.xml > report.html

# Extract open ports
grep "open" scan_results.gnmap

# Find specific services
grep -i "ssh\|telnet\|ftp" scan_results.gnmap

# Extract live hosts
grep "Status: Up" scan_results.gnmap | cut -d' ' -f2

#!/usr/bin/env python3
import xml.etree.ElementTree as ET
import sys

def parse_nmap_xml(xml_file):
    tree = ET.parse(xml_file)
    root = tree.getroot()

    results = []

    for host in root.findall('host'):
        # Get host IP
        ip = host.find('address').get('addr')

        # Get hostname if available
        hostname = ""
        hostnames = host.find('hostnames')
        if hostnames is not None:
            hostname_elem = hostnames.find('hostname')
            if hostname_elem is not None:
                hostname = hostname_elem.get('name')

        # Get open ports
        ports = host.find('ports')
        if ports is not None:
            for port in ports.findall('port'):
                state = port.find('state').get('state')
                if state == 'open':
                    port_num = port.get('portid')
                    protocol = port.get('protocol')
                    service = port.find('service')
                    service_name = service.get('name') if service is not None else 'unknown'

                    results.append({
                        'ip': ip,
                        'hostname': hostname,
                        'port': port_num,
                        'protocol': protocol,
                        'service': service_name
                    })

    return results

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 parse_nmap.py <xml_file>")
        sys.exit(1)

    results = parse_nmap_xml(sys.argv[1])

    print(f"{'IP':<15} {'Hostname':<20} {'Port':<8} {'Protocol':<10} {'Service'}")
    print("-" * 70)

    for result in results:
        print(f"{result['ip']:<15} {result['hostname']:<20} {result['port']:<8} {result['protocol']:<10} {result['service']}")

# Discover live hosts
nmap -sn 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

# ARP scan for local segment
nmap -PR 192.168.1.0/24

# Quick port scan of common services
nmap -sS --top-ports 1000 -T4 -oA quick_scan target_list.txt

# Comprehensive scan of discovered hosts
nmap -sS -sU -p- -A -T4 -oA comprehensive_scan target_list.txt

# Deep service analysis
nmap -sC -sV -p- -A --script "not brute and not dos and not exploit" \
     -oA service_enum target_list.txt

# DNS enumeration
nmap -sL target_domain.com

# Subdomain discovery
nmap --script dns-brute target_domain.com

# Stealthy external scan
nmap -sS -T2 -f --randomize-hosts \
     --source-port 53 -oA external_scan \
     target_ranges.txt

# Web service enumeration
nmap -p 80,443,8080,8443 \
     --script http-enum,http-headers,http-methods,ssl-enum-ciphers \
     -oA web_services target_list.txt

# Comprehensive vulnerability scan
nmap -sV --script "vuln and not (dos or exploit or brute)" \
     --script-args vulns.showall \
     -oA vuln_assessment target_list.txt

# Specific vulnerability checks
nmap --script ms17-010,eternal-blue,heartbleed,poodle \
     -p 445,443 target_list.txt

# Export Nmap results to Metasploit
db_import scan_results.xml

# Use Nmap from within Metasploit
db_nmap -sS -A 192.168.1.0/24

# Import Nmap results into Nessus
# Export as XML and import through Nessus interface

# Use Nmap for host discovery, Nessus for vulnerability assessment
nmap -sn 192.168.1.0/24 -oG live_hosts.txt

#!/bin/bash
# automated_recon.sh

TARGET=$1
OUTPUT_DIR="recon_$(date +%Y%m%d_%H%M%S)"

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi

mkdir -p "$OUTPUT_DIR"
cd "$OUTPUT_DIR"

echo "[+] Starting reconnaissance of $TARGET"

# Phase 1: Host Discovery
echo "[+] Phase 1: Host Discovery"
nmap -sn "$TARGET" -oA host_discovery

# Extract live hosts
grep "Status: Up" host_discovery.gnmap | cut -d' ' -f2 > live_hosts.txt

if [ ! -s live_hosts.txt ]; then
    echo "[-] No live hosts found"
    exit 1
fi

echo "[+] Found $(wc -l < live_hosts.txt) live hosts"

# Phase 2: Port Scanning
echo "[+] Phase 2: Port Scanning"
nmap -sS --top-ports 1000 -T4 -iL live_hosts.txt -oA port_scan

# Phase 3: Service Detection
echo "[+] Phase 3: Service Detection"
nmap -sC -sV -iL live_hosts.txt -oA service_detection

# Phase 4: Vulnerability Assessment
echo "[+] Phase 4: Vulnerability Assessment"
nmap --script vuln -iL live_hosts.txt -oA vulnerability_scan

# Generate summary report
echo "[+] Generating summary report"
{
    echo "Reconnaissance Summary Report"
    echo "============================="
    echo "Target: $TARGET"
    echo "Date: $(date)"
    echo ""
    echo "Live Hosts: $(wc -l < live_hosts.txt)"
    echo ""
    echo "Open Ports Summary:"
    grep "open" port_scan.gnmap | cut -d' ' -f3 | sort | uniq -c | sort -nr
    echo ""
    echo "Services Detected:"
    grep -oP '\d+/tcp\s+open\s+\K\S+' service_detection.nmap | sort | uniq -c | sort -nr
} > summary_report.txt

echo "[+] Reconnaissance complete. Results saved in $OUTPUT_DIR/"

# Optimized scanning for different scenarios

# Fast internal network scan
nmap -sS -T4 --min-hostgroup 50 --max-rtt-timeout 100ms \
     --initial-rtt-timeout 50ms --max-retries 1 \
     --top-ports 100 192.168.1.0/24

# Stealth external scan
nmap -sS -T1 --scan-delay 5s --max-scan-delay 10s \
     --randomize-hosts target_list.txt

# Balanced comprehensive scan
nmap -sS -T3 --min-hostgroup 10 --max-rtt-timeout 500ms \
     --max-retries 2 -p- target_list.txt

# Memory optimization for large scans
ulimit -n 65536  # Increase file descriptor limit

# Parallel scanning with GNU parallel
parallel -j 4 "nmap -sS -T4 --top-ports 1000 -oA scan_{} {}" \
         ::: 192.168.1.0/26 192.168.1.64/26 192.168.1.128/26 192.168.1.192/26

# Distributed scanning
nmap --shard 1/4 -sS target_range  # Scanner 1 of 4
nmap --shard 2/4 -sS target_range  # Scanner 2 of 4

# Use conservative timing to avoid service disruption
nmap -T2 --scan-delay 1s target

# Limit concurrent connections
nmap --max-parallelism 10 target

# Avoid DoS-prone scripts
nmap --script "safe and not dos" target

# Review local logs after scanning
tail -f /var/log/nmap.log

# Use decoy scans to obscure origin
nmap -D RND:5 target

# Use jump boxes or dedicated scanning systems
ssh jump_box "nmap -sS target_network"

# Encrypt sensitive scan results
gpg --cipher-algo AES256 --compress-algo 1 --symmetric scan_results.xml

# Use secure file transfer
scp scan_results.xml.gpg secure_server:/encrypted_storage/

-- Advanced service enumeration script
local nmap = require "nmap"
local shortport = require "shortport"
local http = require "http"
local stdnse = require "stdnse"
local json = require "json"

description = [[
Advanced HTTP service fingerprinting with technology stack detection.
]]

author = "Security Researcher"
license = "Same as Nmap"
categories = {"safe", "discovery", "version"}

portrule = shortport.http

action = function(host, port)
    local results = {}

    -- Basic HTTP request
    local response = http.get(host, port, "/")
    if not response or not response.status then
        return nil
    end

    results["status"] = response.status

    -- Server header analysis
    if response.header and response.header["server"] then
        results["server"] = response.header["server"]
    end

    -- Technology stack detection
    local technologies = {}

    -- Check for common frameworks
    if response.body then
        if string.match(response.body, "wp%-content") then
            table.insert(technologies, "WordPress")
        end
        if string.match(response.body, "Powered by Drupal") then
            table.insert(technologies, "Drupal")
        end
        if string.match(response.body, "X%-Powered%-By.*PHP") then
            table.insert(technologies, "PHP")
        end
    end

    if #technologies > 0 then
        results["technologies"] = technologies
    end

    -- Security headers check
    local security_headers = {}
    local headers_to_check = {
        "x-frame-options",
        "x-xss-protection", 
        "x-content-type-options",
        "strict-transport-security",
        "content-security-policy"
    }

    for _, header in ipairs(headers_to_check) do
        if response.header[header] then
            security_headers[header] = response.header[header]
        end
    end

    if next(security_headers) then
        results["security_headers"] = security_headers
    end

    return stdnse.format_output(true, results)
end

#!/usr/bin/env python3
import subprocess
import json
import requests
import xml.etree.ElementTree as ET
from datetime import datetime

class NmapAPI:
    def __init__(self, api_endpoint=None, api_key=None):
        self.api_endpoint = api_endpoint
        self.api_key = api_key

    def run_scan(self, targets, scan_type="comprehensive", output_format="json"):
        """Execute Nmap scan and return structured results"""

        scan_configs = {
            "quick": "-sS --top-ports 100 -T4",
            "comprehensive": "-sS -sV -sC -O -A --script 'not brute and not dos'",
            "stealth": "-sS -T2 -f --source-port 53",
            "vulnerability": "--script vuln"
        }

        nmap_args = scan_configs.get(scan_type, scan_configs["comprehensive"])

        # Construct Nmap command
        cmd = f"nmap {nmap_args} -oX - {targets}"

        try:
            # Execute scan
            process = subprocess.Popen(
                cmd.split(),
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,
                text=True
            )
            stdout, stderr = process.communicate()

            if process.returncode != 0:
                raise Exception(f"Nmap execution failed: {stderr}")

            # Parse XML output
            results = self.parse_xml_output(stdout)

            # Send to API if configured
            if self.api_endpoint:
                self.send_to_api(results)

            return results

        except Exception as e:
            print(f"Scan failed: {e}")
            return None

    def parse_xml_output(self, xml_output):
        """Parse Nmap XML output into structured format"""
        root = ET.fromstring(xml_output)

        scan_info = {
            "scan_time": datetime.now().isoformat(),
            "scanner_version": root.get("version"),
            "hosts": []
        }

        for host in root.findall("host"):
            host_info = {
                "ip": host.find("address").get("addr"),
                "status": host.find("status").get("state"),
                "hostnames": [],
                "ports": [],
                "os_matches": []
            }

            # Extract hostnames
            hostnames_elem = host.find("hostnames")
            if hostnames_elem is not None:
                for hostname in hostnames_elem.findall("hostname"):
                    host_info["hostnames"].append({
                        "name": hostname.get("name"),
                        "type": hostname.get("type")
                    })

            # Extract ports
            ports_elem = host.find("ports")
            if ports_elem is not None:
                for port in ports_elem.findall("port"):
                    port_info = {
                        "port": int(port.get("portid")),
                        "protocol": port.get("protocol"),
                        "state": port.find("state").get("state")
                    }

                    # Service information
                    service_elem = port.find("service")
                    if service_elem is not None:
                        port_info["service"] = {
                            "name": service_elem.get("name"),
                            "product": service_elem.get("product"),
                            "version": service_elem.get("version"),
                            "extrainfo": service_elem.get("extrainfo")
                        }

                    # Script results
                    scripts = []
                    for script in port.findall("script"):
                        scripts.append({
                            "id": script.get("id"),
                            "output": script.get("output")
                        })
                    if scripts:
                        port_info["scripts"] = scripts

                    host_info["ports"].append(port_info)

            # OS detection
            os_elem = host.find("os")
            if os_elem is not None:
                for osmatch in os_elem.findall("osmatch"):
                    host_info["os_matches"].append({
                        "name": osmatch.get("name"),
                        "accuracy": int(osmatch.get("accuracy"))
                    })

            scan_info["hosts"].append(host_info)

        return scan_info

    def send_to_api(self, results):
        """Send results to external API"""
        headers = {
            "Content-Type": "application/json",
            "Authorization": f"Bearer {self.api_key}"
        }

        try:
            response = requests.post(
                f"{self.api_endpoint}/scan-results",
                headers=headers,
                json=results,
                timeout=30
            )
            response.raise_for_status()
            print("Results successfully sent to API")
        except Exception as e:
            print(f"Failed to send results to API: {e}")

    def generate_report(self, results, format_type="markdown"):
        """Generate formatted report from scan results"""
        if format_type == "markdown":
            return self._generate_markdown_report(results)
        elif format_type == "html":
            return self._generate_html_report(results)
        else:
            return json.dumps(results, indent=2)

    def _generate_markdown_report(self, results):
        """Generate Markdown report"""
        report = f"""# Network Scan Report

**Scan Time:** {results['scan_time']}
**Scanner Version:** {results['scanner_version']}
**Total Hosts:** {len(results['hosts'])}

## Summary

"""

        alive_hosts = [h for h in results['hosts'] if h['status'] == 'up']
        report += f"- **Live Hosts:** {len(alive_hosts)}\n"

        total_ports = sum(len(h['ports']) for h in alive_hosts)
        open_ports = sum(len([p for p in h['ports'] if p['state'] == 'open']) for h in alive_hosts)
        report += f"- **Total Ports Scanned:** {total_ports}\n"
        report += f"- **Open Ports Found:** {open_ports}\n\n"

        # Host details
        for host in alive_hosts:
            report += f"## Host: {host['ip']}\n\n"

            if host['hostnames']:
                report += "**Hostnames:**\n"
                for hostname in host['hostnames']:
                    report += f"- {hostname['name']} ({hostname['type']})\n"
                report += "\n"

            if host['os_matches']:
                report += "**Operating System:**\n"
                for os_match in host['os_matches'][:3]:  # Top 3 matches
                    report += f"- {os_match['name']} ({os_match['accuracy']}% accuracy)\n"
                report += "\n"

            open_ports = [p for p in host['ports'] if p['state'] == 'open']
            if open_ports:
                report += "**Open Ports:**\n\n"
                report += "| Port | Protocol | Service | Version |\n"
                report += "|------|----------|---------|----------|\n"

                for port in open_ports:
                    service_info = ""
                    if 'service' in port and port['service']:
                        service = port['service']
                        service_info = f"{service.get('name', 'unknown')}"
                        if service.get('product'):
                            service_info += f" ({service['product']}"
                            if service.get('version'):
                                service_info += f" {service['version']}"
                            service_info += ")"

                    report += f"| {port['port']} | {port['protocol']} | {service_info} | |\n"

                report += "\n"

            # Script results
            scripts_found = False
            for port in open_ports:
                if 'scripts' in port:
                    if not scripts_found:
                        report += "**Script Results:**\n\n"
                        scripts_found = True

                    report += f"### Port {port['port']}/{port['protocol']}\n\n"
                    for script in port['scripts']:
                        report += f"**{script['id']}:**\n```
{% endraw %}
\n{script['output']}\n
{% raw %}
```\n\n"

        return report

    def _generate_html_report(self, results):
        """Generate HTML report"""
        html_template = """<!DOCTYPE html>
<html>
<head>
    <title>Network Scan Report</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .host { border: 1px solid #ddd; margin: 20px 0; padding: 15px; border-radius: 5px; }
        .port-table { width: 100%; border-collapse: collapse; margin: 10px 0; }
        .port-table th, .port-table td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        .port-table th { background-color: #f2f2f2; }
        .script-output { background-color: #f8f8f8; padding: 10px; border-left: 4px solid #007cba; margin: 10px 0; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Network Scan Report</h1>
        <p><strong>Scan Time:</strong> {scan_time}</p>
        <p><strong>Scanner Version:</strong> {scanner_version}</p>
        <p><strong>Total Hosts:</strong> {total_hosts}</p>
    </div>
""".format(
            scan_time=results['scan_time'],
            scanner_version=results['scanner_version'],
            total_hosts=len(results['hosts'])
        )

        alive_hosts = [h for h in results['hosts'] if h['status'] == 'up']

        for host in alive_hosts:
            html_template += f"""
    <div class="host">
        <h2>Host: {host['ip']}</h2>
"""

            if host['hostnames']:
                html_template += "<h3>Hostnames:</h3><ul>"
                for hostname in host['hostnames']:
                    html_template += f"<li>{hostname['name']} ({hostname['type']})</li>"
                html_template += "</ul>"

            open_ports = [p for p in host['ports'] if p['state'] == 'open']
            if open_ports:
                html_template += """
        <h3>Open Ports:</h3>
        <table class="port-table">
            <tr><th>Port</th><th>Protocol</th><th>Service</th><th>Version</th></tr>
"""

                for port in open_ports:
                    service_info = "unknown"
                    version_info = ""

                    if 'service' in port and port['service']:
                        service = port['service']
                        service_info = service.get('name', 'unknown')
                        if service.get('product'):
                            version_info = service['product']
                            if service.get('version'):
                                version_info += f" {service['version']}"

                    html_template += f"""
            <tr>
                <td>{port['port']}</td>
                <td>{port['protocol']}</td>
                <td>{service_info}</td>
                <td>{version_info}</td>
            </tr>
"""

                html_template += "</table>"

            html_template += "</div>"

        html_template += """
</body>
</html>
"""

        return html_template

# Usage example
if __name__ == "__main__":
    # Initialize scanner
    scanner = NmapAPI(
        api_endpoint="https://api.example.com",
        api_key="your-api-key"
    )

    # Run comprehensive scan
    results = scanner.run_scan("192.168.1.0/24", scan_type="comprehensive")

    if results:
        # Generate reports
        markdown_report = scanner.generate_report(results, "markdown")
        html_report = scanner.generate_report(results, "html")

        # Save reports
        with open("scan_report.md", "w") as f:
            f.write(markdown_report)

        with open("scan_report.html", "w") as f:
            f.write(html_report)

        print("Scan completed and reports generated")

#!/bin/bash
# continuous_monitoring.sh

# Configuration
CONFIG_FILE="/etc/nmap-monitor/config.conf"
STATE_DIR="/var/lib/nmap-monitor"
LOG_FILE="/var/log/nmap-monitor.log"
ALERT_WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

# Load configuration
source "$CONFIG_FILE" 2>/dev/null || {
    echo "Configuration file not found. Creating default configuration..."
    mkdir -p "$(dirname "$CONFIG_FILE")"
    cat > "$CONFIG_FILE" << EOF
MONITOR_TARGETS="192.168.1.0/24"
SCAN_INTERVAL=3600  # 1 hour
ALERT_ON_NEW_HOSTS=true
ALERT_ON_NEW_PORTS=true
ALERT_ON_SERVICE_CHANGES=true
NMAP_OPTIONS="-sS --top-ports 1000 -sV"
EOF
    source "$CONFIG_FILE"
}

# Create directories
mkdir -p "$STATE_DIR"
mkdir -p "$(dirname "$LOG_FILE")"

# Logging function
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Send alert function
send_alert() {
    local message="$1"
    local severity="${2:-INFO}"

    # Log the alert
    log "ALERT [$severity]: $message"

    # Send to webhook if configured
    if [[ -n "$ALERT_WEBHOOK" ]]; then
        curl -X POST -H 'Content-type: application/json' \
            --data "{\"text\":\"🚨 Network Monitor Alert [$severity]: $message\"}" \
            "$ALERT_WEBHOOK" 2>/dev/null
    fi

    # Send email if configured
    if [[ -n "$ALERT_EMAIL" ]]; then
        echo "$message" | mail -s "Network Monitor Alert [$severity]" "$ALERT_EMAIL"
    fi
}

# Compare scan results
compare_results() {
    local current_scan="$1"
    local previous_scan="$2"

    if [[ ! -f "$previous_scan" ]]; then
        log "No previous scan found. Saving current scan as baseline."
        cp "$current_scan" "$previous_scan"
        return 0
    fi

    # Extract host and port information
    awk '/Host:/ {host=$2} /open/ {print host":"$1":"$3}' "$current_scan" > "$STATE_DIR/current_hosts_ports.tmp"
    awk '/Host:/ {host=$2} /open/ {print host":"$1":"$3}' "$previous_scan" > "$STATE_DIR/previous_hosts_ports.tmp"

    # Check for new hosts
    if [[ "$ALERT_ON_NEW_HOSTS" == "true" ]]; then
        awk -F: '{print $1}' "$STATE_DIR/current_hosts_ports.tmp" | sort -u > "$STATE_DIR/current_hosts.tmp"
        awk -F: '{print $1}' "$STATE_DIR/previous_hosts_ports.tmp" | sort -u > "$STATE_DIR/previous_hosts.tmp"

        new_hosts=$(comm -23 "$STATE_DIR/current_hosts.tmp" "$STATE_DIR/previous_hosts.tmp")
        if [[ -n "$new_hosts" ]]; then
            send_alert "New hosts detected: $new_hosts" "HIGH"
        fi
    fi

    # Check for new ports
    if [[ "$ALERT_ON_NEW_PORTS" == "true" ]]; then
        new_ports=$(comm -23 "$STATE_DIR/current_hosts_ports.tmp" "$STATE_DIR/previous_hosts_ports.tmp")
        if [[ -n "$new_ports" ]]; then
            send_alert "New open ports detected: $new_ports" "MEDIUM"
        fi
    fi

    # Check for disappeared hosts/ports
    disappeared=$(comm -13 "$STATE_DIR/current_hosts_ports.tmp" "$STATE_DIR/previous_hosts_ports.tmp")
    if [[ -n "$disappeared" ]]; then
        send_alert "Hosts or ports no longer accessible: $disappeared" "LOW"
    fi

    # Update baseline
    cp "$current_scan" "$previous_scan"
}

# Main monitoring function
run_monitor() {
    log "Starting network monitoring scan"

    local scan_output="$STATE_DIR/current_scan.nmap"
    local baseline_scan="$STATE_DIR/baseline_scan.nmap"

    # Run Nmap scan
    if nmap $NMAP_OPTIONS $MONITOR_TARGETS > "$scan_output" 2>&1; then
        log "Scan completed successfully"

        # Compare with previous results
        compare_results "$scan_output" "$baseline_scan"
    else
        send_alert "Nmap scan failed" "HIGH"
        log "Scan failed. Check configuration and network connectivity."
    fi
}

# Service status monitoring
monitor_service_changes() {
    local current_services="$STATE_DIR/current_services.txt"
    local baseline_services="$STATE_DIR/baseline_services.txt"

    # Extract service information
    grep -E "(open|filtered)" "$STATE_DIR/current_scan.nmap" | \
        awk '{print $1":"$3":"$5}' > "$current_services"

    if [[ -f "$baseline_services" ]] && [[ "$ALERT_ON_SERVICE_CHANGES" == "true" ]]; then
        service_changes=$(diff "$baseline_services" "$current_services" 2>/dev/null)
        if [[ -n "$service_changes" ]]; then
            send_alert "Service changes detected: $service_changes" "MEDIUM"
        fi
    fi

    cp "$current_services" "$baseline_services"
}

# Performance monitoring
monitor_performance() {
    local scan_start_time=$(date +%s)
    run_monitor
    local scan_end_time=$(date +%s)
    local scan_duration=$((scan_end_time - scan_start_time))

    log "Scan completed in ${scan_duration} seconds"

    # Alert if scan takes too long (indicates potential issues)
    if [[ $scan_duration -gt 1800 ]]; then  # 30 minutes
        send_alert "Scan taking longer than expected: ${scan_duration} seconds" "MEDIUM"
    fi
}

# Main execution
case "${1:-monitor}" in
    "monitor")
        log "Network monitoring started"
        monitor_performance
        monitor_service_changes
        ;;
    "daemon")
        log "Starting continuous monitoring daemon"
        while true; do
            monitor_performance
            monitor_service_changes
            log "Sleeping for ${SCAN_INTERVAL} seconds"
            sleep "$SCAN_INTERVAL"
        done
        ;;
    "test-alert")
        send_alert "Test alert from network monitor" "INFO"
        ;;
    "status")
        if [[ -f "$STATE_DIR/current_scan.nmap" ]]; then
            echo "Last scan: $(stat -c %y "$STATE_DIR/current_scan.nmap")"
            echo "Monitored targets: $MONITOR_TARGETS"
            echo "Scan interval: $SCAN_INTERVAL seconds"
        else
            echo "No scans found"
        fi
        ;;
    *)
        echo "Usage: $0 {monitor|daemon|test-alert|status}"
        exit 1
        ;;
esac

#!/bin/bash
# nmap_detection.sh

# Analyze firewall logs for scanning patterns
analyze_firewall_logs() {
    local log_file="$1"
    local time_window="${2:-300}"  # 5 minutes

    echo "Analyzing firewall logs for potential Nmap scans..."

    # Detect port scanning patterns
    awk -v window="$time_window" '
    BEGIN { 
        print "Potential port scans detected:"
        print "==============================="
    }
    {
        # Extract timestamp, source IP, and destination port
        if (match($0, /([0-9]{1,3}\.){3}[0-9]{1,3}/)) {
            src_ip = substr($0, RSTART, RLENGTH)
            if (match($0, /DPT=([0-9]+)/)) {
                dst_port = substr($0, RSTART+4, RLENGTH-4)
                timestamp = $1 " " $2 " " $3

                # Count connections per source IP
                connections[src_ip]++
                ports[src_ip][dst_port] = 1
                first_seen[src_ip] = (first_seen[src_ip] ? first_seen[src_ip] : timestamp)
            }
        }
    }
    END {
        for (ip in connections) {
            port_count = 0
            for (port in ports[ip]) port_count++

            # Flag IPs connecting to many ports
            if (port_count > 10) {
                printf "Source: %s - %d connections to %d ports (First seen: %s)\n", 
                       ip, connections[ip], port_count, first_seen[ip]
            }
        }
    }' "$log_file"
}

# Detect SYN scan patterns
detect_syn_scans() {
    local log_file="$1"

    echo -e "\nSYN scan patterns:"
    echo "=================="

    # Look for high frequency of SYN packets
    grep "SYN" "$log_file" | \
    awk '{print $1 " " $2 " " $3, $(NF-1)}' | \
    sort | uniq -c | \
    awk '$1 > 50 {print "High SYN frequency: " $0}'
}

# Main analysis
if [[ $# -lt 1 ]]; then
    echo "Usage: $0 <firewall_log_file>"
    exit 1
fi

analyze_firewall_logs "$1"
detect_syn_scans "$1"

#!/usr/bin/env python3
import socket
import threading
import logging
import datetime
from collections import defaultdict

class PortHoneypot:
    def __init__(self, ports=None, bind_ip="0.0.0.0"):
        self.ports = ports or [21, 22, 23, 25, 53, 80, 110, 143, 443, 993, 995]
        self.bind_ip = bind_ip
        self.connections = defaultdict(int)
        self.scan_attempts = defaultdict(list)

        # Configure logging
        logging.basicConfig(
            level=logging.INFO,
            format='%(asctime)s - %(levelname)s - %(message)s',
            handlers=[
                logging.FileHandler('honeypot.log'),
                logging.StreamHandler()
            ]
        )
        self.logger = logging.getLogger(__name__)

    def handle_connection(self, client_socket, client_address, port):
        """Handle individual connection attempts"""
        try:
            self.connections[client_address[0]] += 1
            self.scan_attempts[client_address[0]].append({
                'port': port,
                'timestamp': datetime.datetime.now(),
                'source_port': client_address[1]
            })

            self.logger.warning(f"Connection attempt from {client_address[0]}:{client_address[1]} to port {port}")

            # Send fake banner based on port
            banners = {
                21: b"220 FTP Server ready\r\n",
                22: b"SSH-2.0-OpenSSH_8.0\r\n",
                23: b"Telnet Server Ready\r\n",
                25: b"220 SMTP Server Ready\r\n",
                80: b"HTTP/1.1 200 OK\r\nServer: Apache/2.4.41\r\n\r\n<html><body>Hello</body></html>",
                443: b"HTTP/1.1 400 Bad Request\r\n\r\n"
            }

            if port in banners:
                client_socket.send(banners[port])

            # Keep connection open briefly to appear real
            client_socket.settimeout(5)
            try:
                data = client_socket.recv(1024)
                if data:
                    self.logger.info(f"Received data from {client_address[0]}: {data[:100]}")
            except socket.timeout:
                pass

        except Exception as e:
            self.logger.error(f"Error handling connection: {e}")
        finally:
            client_socket.close()

    def start_listener(self, port):
        """Start listener for specific port"""
        try:
            server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            server_socket.bind((self.bind_ip, port))
            server_socket.listen(5)

            self.logger.info(f"Honeypot listening on {self.bind_ip}:{port}")

            while True:
                client_socket, client_address = server_socket.accept()

                # Handle connection in separate thread
                handler = threading.Thread(
                    target=self.handle_connection,
                    args=(client_socket, client_address, port)
                )
                handler.daemon = True
                handler.start()

        except Exception as e:
            self.logger.error(f"Error on port {port}: {e}")

    def analyze_patterns(self):
        """Analyze connection patterns for scanning detection"""
        current_time = datetime.datetime.now()

        for ip, attempts in self.scan_attempts.items():
            # Check for port scanning patterns
            recent_attempts = [
                a for a in attempts 
                if (current_time - a['timestamp']).seconds < 300  # Last 5 minutes
            ]

            if len(recent_attempts) > 5:
                ports_scanned = set(a['port'] for a in recent_attempts)
                self.logger.critical(
                    f"Potential port scan from {ip}: "
                    f"{len(recent_attempts)} attempts on {len(ports_scanned)} ports"
                )

                # Generate alert
                self.generate_alert(ip, recent_attempts)

    def generate_alert(self, source_ip, attempts):
        """Generate security alert"""
        alert_data = {
            'source_ip': source_ip,
            'attempt_count': len(attempts),
            'ports_targeted': list(set(a['port'] for a in attempts)),
            'time_span': f"{attempts[0]['timestamp']} to {attempts[-1]['timestamp']}",
            'total_connections': self.connections[source_ip]
        }

        # Write to alert file
        with open('security_alerts.json', 'a') as f:
            import json
            f.write(json.dumps(alert_data) + '\n')

        # Here you could integrate with SIEM, send emails, etc.
        self.logger.critical(f"SECURITY ALERT: {alert_data}")

    def start(self):
        """Start all honeypot listeners"""
        threads = []

        for port in self.ports:
            thread = threading.Thread(target=self.start_listener, args=(port,))
            thread.daemon = True
            thread.start()
            threads.append(thread)

        # Start pattern analysis thread
        def analyze_loop():
            while True:
                import time
                time.sleep(60)  # Analyze every minute
                self.analyze_patterns()

        analysis_thread = threading.Thread(target=analyze_loop)
        analysis_thread.daemon = True
        analysis_thread.start()

        # Keep main thread alive
        try:
            for thread in threads:
                thread.join()
        except KeyboardInterrupt:
            self.logger.info("Honeypot shutting down...")

if __name__ == "__main__":
    honeypot = PortHoneypot()
    honeypot.start()

# IPv6-specific reconnaissance techniques
nmap -6 2001:db8::/32

# IPv6 neighbor discovery
nmap -6 --script ipv6-node-info fe80::/64

# Dual-stack enumeration
nmap -4 -6 target_domain.com

# Kubernetes API discovery
nmap -p 6443,8080,10250,10255 --script kubernetes-* target_range

# Docker daemon enumeration
nmap -p 2375,2376 --script docker-* target_range

# Container registry scanning
nmap -p 5000 --script registry-* target_range

# IoT device identification
nmap -sU -p 161 --script snmp-info target_range

# Industrial control system discovery
nmap -p 502,44818,1911,9600 --script modbus-*,s7-* target_range

# Embedded device fingerprinting
nmap --script http-favicon,http-title,http-server-header target_range

# API endpoint discovery
nmap -p 80,443,8080,8443 --script http-enum,http-methods target_range

# GraphQL enumeration
nmap -p 80,443 --script graphql-* target_range

# REST API security testing
nmap -p 80,443 --script http-unsafe-output-escaping,http-sql-injection target_range

#!/bin/bash
# Professional reconnaissance workflow

# Phase 1: Intelligence Gathering
echo "[+] Phase 1: Intelligence Gathering"
amass enum -d target.com -o amass_results.txt
subfinder -d target.com -o subfinder_results.txt
assetfinder target.com | tee assetfinder_results.txt

# Combine and deduplicate results
cat amass_results.txt subfinder_results.txt assetfinder_results.txt | \
    sort -u > all_subdomains.txt

# Phase 2: Host Discovery with Nmap
echo "[+] Phase 2: Host Discovery"
nmap -sn -iL all_subdomains.txt -oA host_discovery

# Extract live hosts
grep "Status: Up" host_discovery.gnmap | cut -d' ' -f2 > live_hosts.txt

# Phase 3: Port Discovery
echo "[+] Phase 3: Port Discovery"
nmap -sS --top-ports 1000 -T4 -iL live_hosts.txt -oA port_discovery

# Phase 4: Service Enumeration
echo "[+] Phase 4: Service Enumeration"
nmap -sC -sV -A -iL live_hosts.txt -oA service_enum

# Phase 5: Vulnerability Assessment
echo "[+] Phase 5: Vulnerability Assessment"
nmap --script vuln -iL live_hosts.txt -oA vuln_assessment

# Phase 6: Reporting
echo "[+] Phase 6: Generating Reports"
python3 generate_report.py service_enum.xml vuln_assessment.xml

-- Cloud service detection script
local nmap = require "nmap"
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"

description = [[
Identifies cloud service providers and configurations.
]]

author = "Security Researcher"
categories = {"safe", "discovery", "cloud"}

portrule = function(host, port)
    return shortport.http(host, port) or 
           shortport.port_or_service({80, 443, 8080, 8443}, {"http", "https"})(host, port)
end

action = function(host, port)
    local results = {}

    -- Check for cloud provider indicators
    local response = http.get(host, port, "/")
    if response and response.header then
        -- AWS indicators
        if response.header["server"] and string.match(response.header["server"], "AmazonS3") then
            results["provider"] = "AWS S3"
        end

        -- Azure indicators
        if response.header["server"] and string.match(response.header["server"], "Microsoft-Azure") then
            results["provider"] = "Microsoft Azure"
        end

        -- Google Cloud indicators
        if response.header["server"] and string.match(response.header["server"], "Google") then
            results["provider"] = "Google Cloud"
        end

        -- Check for metadata endpoints
        local metadata_paths = {
            "/latest/meta-data/",  -- AWS
            "/metadata/instance",  -- Azure
            "/computeMetadata/v1/" -- GCP
        }

        for _, path in ipairs(metadata_paths) do
            local meta_response = http.get(host, port, path)
            if meta_response and meta_response.status == 200 then
                results["metadata_accessible"] = true
                break
            end
        end
    end

    if next(results) then
        return stdnse.format_output(true, results)
    end

    return nil
end

# Reconnaissance Rules of Engagement Template

## Scope Definition
- **In-Scope Networks**: [Define specific IP ranges, domains, applications]
- **Out-of-Scope Systems**: [Explicitly exclude systems/networks]
- **Time Windows**: [Specify approved scanning times]

## Technical Constraints
- **Scanning Intensity**: Maximum timing template and rate limits
- **Prohibited Techniques**: DoS testing, exploitation attempts, brute forcing
- **Detection Acceptance**: Acknowledge scanning will generate security alerts

## Contact Information
- **Primary Contact**: [Technical point of contact]
- **Emergency Contact**: [24/7 contact for issues]
- **Escalation Path**: [Management chain for critical issues]

## Deliverables
- **Raw Scan Data**: XML/JSON format scan results
- **Executive Summary**: High-level findings and risk assessment
- **Technical Report**: Detailed findings with remediation recommendations
- **Remediation Tracking**: Follow-up testing and validation

#!/bin/bash
# Lab environment setup script

# Create isolated network segments
docker network create --driver bridge recon_lab_internal
docker network create --driver bridge recon_lab_dmz
docker network create --driver bridge recon_lab_external

# Deploy vulnerable applications
docker run -d --name dvwa --network recon_lab_internal vulnerables/web-dvwa
docker run -d --name metasploitable --network recon_lab_internal tleemcjr/metasploitable2
docker run -d --name juice-shop --network recon_lab_dmz bkimminich/juice-shop

# Deploy monitoring and logging
docker run -d --name elk-stack \
    --network recon_lab_internal \
    -p 5601:5601 -p 9200:9200 -p 5044:5044 \
    sebp/elk

# Deploy honeypots
docker run -d --name cowrie-honeypot \
    --network recon_lab_dmz \
    -p 2222:2222 \
    cowrie/cowrie

# Create scanning targets with various operating systems
docker run -d --name ubuntu-target --network recon_lab_internal ubuntu:latest sleep infinity
docker run -d --name centos-target --network recon_lab_internal centos:latest sleep infinity
docker run -d --name windows-target --network recon_lab_internal mcr.microsoft.com/windows/servercore:ltsc2019

echo "Lab environment deployed. Networks:"
docker network ls | grep recon_lab
echo ""
echo "Running containers:"
docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"

# Download and install Istio
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.19.0
export PATH=$PWD/bin:$PATH

# Install Istio with default configuration
istioctl install --set values.defaultRevision=default

# Enable automatic sidecar injection for default namespace
kubectl label namespace default istio-injection=enabled

# Verify installation
kubectl get pods -n istio-system
istioctl verify-install

# Install Kiali, Prometheus, Grafana, and Jaeger
kubectl apply -f samples/addons/

# Verify all components are running
kubectl get pods -n istio-system

# bookinfo-app.yaml
apiVersion: v1
kind: Service
metadata:
  name: productpage
  labels:
    app: productpage
    service: productpage
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: productpage
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bookinfo-productpage
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-v1
  labels:
    app: productpage
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: productpage
      version: v1
  template:
    metadata:
      labels:
        app: productpage
        version: v1
    spec:
      serviceAccountName: bookinfo-productpage
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v1:1.17.0
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        readinessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 10
          periodSeconds: 5
        livenessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 30
          periodSeconds: 10

kubectl apply -f bookinfo-app.yaml
kubectl get pods -l app=productpage

# traffic-management.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        end-user:
          exact: jason
    route:
    - destination:
        host: productpage
        subset: v1
  - route:
    - destination:
        host: productpage
        subset: v1
      weight: 100
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http1MaxPendingRequests: 10
        maxRequestsPerConnection: 2
    circuitBreaker:
      consecutiveGatewayErrors: 5
      interval: 30s
      baseEjectionTime: 30s

# gateway.yaml
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

kubectl apply -f traffic-management.yaml
kubectl apply -f gateway.yaml

# blue-green-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-blue
  labels:
    app: productpage
    version: blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: productpage
      version: blue
  template:
    metadata:
      labels:
        app: productpage
        version: blue
    spec:
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v1:1.17.0
        ports:
        - containerPort: 9080
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
        readinessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 10
        livenessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 30
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-green
  labels:
    app: productpage
    version: green
spec:
  replicas: 3
  selector:
    matchLabels:
      app: productpage
      version: green
  template:
    metadata:
      labels:
        app: productpage
        version: green
    spec:
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v2:1.17.0
        ports:
        - containerPort: 9080
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
        readinessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 10
        livenessProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 30

# blue-green-virtual-service.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-bg
spec:
  hosts:
  - productpage
  http:
  - route:
    - destination:
        host: productpage
        subset: blue
      weight: 100
    - destination:
        host: productpage
        subset: green
      weight: 0
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage-bg
spec:
  host: productpage
  subsets:
  - name: blue
    labels:
      version: blue
  - name: green
    labels:
      version: green

#!/bin/bash
# blue-green-switch.sh

CURRENT_COLOR=$(kubectl get virtualservice productpage-bg -o jsonpath='{.spec.http[0].route[0].weight}')

if [ "$CURRENT_COLOR" == "100" ]; then
    echo "Switching from Blue to Green..."
    NEW_BLUE_WEIGHT=0
    NEW_GREEN_WEIGHT=100
else
    echo "Switching from Green to Blue..."
    NEW_BLUE_WEIGHT=100
    NEW_GREEN_WEIGHT=0
fi

# Update virtual service with new weights
kubectl patch virtualservice productpage-bg --type='json' -p="[
  {\"op\": \"replace\", \"path\": \"/spec/http/0/route/0/weight\", \"value\": $NEW_BLUE_WEIGHT},
  {\"op\": \"replace\", \"path\": \"/spec/http/0/route/1/weight\", \"value\": $NEW_GREEN_WEIGHT}
]"

echo "Traffic switched successfully!"

# Wait and verify health
sleep 10
kubectl get virtualservice productpage-bg -o yaml

# canary-deployment.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-canary
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        canary:
          exact: "true"
    route:
    - destination:
        host: productpage
        subset: v2
  - route:
    - destination:
        host: productpage
        subset: v1
      weight: 90
    - destination:
        host: productpage
        subset: v2
      weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage-canary
spec:
  host: productpage
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 50
      http:
        http1MaxPendingRequests: 10
    circuitBreaker:
      consecutiveGatewayErrors: 3
      interval: 10s

#!/bin/bash
# canary-progression.sh

CANARY_STEPS=(10 25 50 75 100)
MONITOR_DURATION=300  # 5 minutes between steps

for WEIGHT in "${CANARY_STEPS[@]}"; do
    STABLE_WEIGHT=$((100 - WEIGHT))

    echo "Setting canary traffic to ${WEIGHT}%, stable to ${STABLE_WEIGHT}%"

    kubectl patch virtualservice productpage-canary --type='json' -p="[
      {\"op\": \"replace\", \"path\": \"/spec/http/1/route/0/weight\", \"value\": $STABLE_WEIGHT},
      {\"op\": \"replace\", \"path\": \"/spec/http/1/route/1/weight\", \"value\": $WEIGHT}
    ]"

    if [ $WEIGHT -lt 100 ]; then
        echo "Monitoring for $MONITOR_DURATION seconds..."
        sleep $MONITOR_DURATION

        # Check error rate
        ERROR_RATE=$(curl -s "http://prometheus:9090/api/v1/query?query=sum(rate(istio_requests_total{destination_service_name=\"productpage\",response_code!~\"2.*\"}[5m]))/sum(rate(istio_requests_total{destination_service_name=\"productpage\"}[5m]))" | jq -r '.data.result[0].value[1] // 0')

        if (( $(echo "$ERROR_RATE > 0.05" | bc -l) )); then
            echo "Error rate too high ($ERROR_RATE), rolling back!"
            kubectl patch virtualservice productpage-canary --type='json' -p="[
              {\"op\": \"replace\", \"path\": \"/spec/http/1/route/0/weight\", \"value\": 100},
              {\"op\": \"replace\", \"path\": \"/spec/http/1/route/1/weight\", \"value\": 0}
            ]"
            exit 1
        fi
    fi
done

echo "Canary deployment completed successfully!"

# ab-testing.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-ab
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        user-group:
          exact: "beta"
    route:
    - destination:
        host: productpage
        subset: v2
  - match:
    - headers:
        user-agent:
          regex: ".*Mobile.*"
    route:
    - destination:
        host: productpage
        subset: v1
      weight: 70
    - destination:
        host: productpage
        subset: v2
      weight: 30
  - route:
    - destination:
        host: productpage
        subset: v1
      weight: 80
    - destination:
        host: productpage
        subset: v2
      weight: 20

# feature-flag-routing.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-features
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        x-feature-new-ui:
          exact: "enabled"
    fault:
      delay:
        percentage:
          value: 0.1
        fixedDelay: 5s
    route:
    - destination:
        host: productpage
        subset: v2
  - match:
    - uri:
        prefix: "/api/v2"
    route:
    - destination:
        host: productpage
        subset: v2
  - route:
    - destination:
        host: productpage
        subset: v1

# geo-routing.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-geo
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        x-forwarded-for:
          regex: "^10\.1\..*"  # US East region
    route:
    - destination:
        host: productpage
        subset: us-east
  - match:
    - headers:
        x-forwarded-for:
          regex: "^10\.2\..*"  # US West region
    route:
    - destination:
        host: productpage
        subset: us-west
  - route:
    - destination:
        host: productpage
        subset: default

# advanced-health-checks.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-v2
spec:
  template:
    spec:
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v2:1.17.0
        readinessProbe:
          httpGet:
            path: /health
            port: 9080
            httpHeaders:
            - name: X-Health-Check
              value: "readiness"
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
          successThreshold: 1
        livenessProbe:
          httpGet:
            path: /health
            port: 9080
            httpHeaders:
            - name: X-Health-Check
              value: "liveness"
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        startupProbe:
          httpGet:
            path: /health
            port: 9080
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 30

# health-checker.py
import requests
import json
import time
from kubernetes import client, config

class HealthChecker:
    def __init__(self, service_name, namespace="default"):
        config.load_incluster_config()
        self.v1 = client.CoreV1Api()
        self.service_name = service_name
        self.namespace = namespace

    def check_pod_health(self, pod_ip):
        """Perform comprehensive health check"""
        try:
            # Basic connectivity
            response = requests.get(f"http://{pod_ip}:9080/health", timeout=5)
            if response.status_code != 200:
                return False

            # Application-specific checks
            app_response = requests.get(f"http://{pod_ip}:9080/productpage", timeout=10)
            if app_response.status_code != 200:
                return False

            # Response time check
            if app_response.elapsed.total_seconds() > 2.0:
                return False

            return True
        except Exception:
            return False

    def get_healthy_pods(self):
        """Return list of healthy pods"""
        pods = self.v1.list_namespaced_pod(
            namespace=self.namespace,
            label_selector=f"app={self.service_name}"
        )

        healthy_pods = []
        for pod in pods.items:
            if pod.status.phase == "Running":
                if self.check_pod_health(pod.status.pod_ip):
                    healthy_pods.append(pod)

        return healthy_pods

    def wait_for_rollout(self, min_healthy=2, timeout=300):
        """Wait for deployment rollout to complete"""
        start_time = time.time()

        while time.time() - start_time < timeout:
            healthy = self.get_healthy_pods()
            if len(healthy) >= min_healthy:
                return True
            time.sleep(10)

        return False

# circuit-breaker.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage-circuit-breaker
spec:
  host: productpage
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http1MaxPendingRequests: 10
        http2MaxRequests: 100
        maxRequestsPerConnection: 2
        maxRetries: 3
        consecutiveGatewayErrors: 5
        h2UpgradePolicy: UPGRADE
    circuitBreaker:
      consecutiveGatewayErrors: 5
      consecutiveServerErrors: 5
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30
    retryPolicy:
      attempts: 3
      perTryTimeout: 2s
      retryOn: gateway-error,connect-failure,refused-stream
  subsets:
  - name: v1
    labels:
      version: v1
    trafficPolicy:
      circuitBreaker:
        consecutiveGatewayErrors: 3
        interval: 5s
  - name: v2
    labels:
      version: v2

# fault-injection.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-fault-test
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        x-test-fault:
          exact: "delay"
    fault:
      delay:
        percentage:
          value: 10
        fixedDelay: 5s
    route:
    - destination:
        host: productpage
        subset: v2
  - match:
    - headers:
        x-test-fault:
          exact: "abort"
    fault:
      abort:
        percentage:
          value: 5
        httpStatus: 503
    route:
    - destination:
        host: productpage
        subset: v2
  - route:
    - destination:
        host: productpage
        subset: v1

# telemetry-config.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: deployment-metrics
spec:
  metrics:
  - providers:
    - name: prometheus
  - overrides:
    - match:
        metric: ALL_METRICS
      tagOverrides:
        deployment_version:
          value: |
            has(source.labels) ? source.labels["version"] : "unknown"
        canary_weight:
          value: |
            has(destination.labels) ? destination.labels["canary-weight"] : "0"

{
  "dashboard": {
    "title": "Zero-Downtime Deployment Dashboard",
    "panels": [
      {
        "title": "Request Rate by Version",
        "type": "graph",
        "targets": [
          {
            "expr": "sum(rate(istio_requests_total{destination_service_name=\"productpage\"}[5m])) by (destination_version)",
            "legendFormat": "Version {{destination_version}}"
          }
        ]
      },
      {
        "title": "Error Rate by Version", 
        "type": "graph",
        "targets": [
          {
            "expr": "sum(rate(istio_requests_total{destination_service_name=\"productpage\",response_code!~\"2.*\"}[5m])) by (destination_version)",
            "legendFormat": "Errors {{destination_version}}"
          }
        ]
      },
      {
        "title": "Response Time Percentiles",
        "type": "graph",
        "targets": [
          {
            "expr": "histogram_quantile(0.50, sum(rate(istio_request_duration_milliseconds_bucket{destination_service_name=\"productpage\"}[5m])) by (destination_version, le))",
            "legendFormat": "P50 {{destination_version}}"
          },
          {
            "expr": "histogram_quantile(0.95, sum(rate(istio_request_duration_milliseconds_bucket{destination_service_name=\"productpage\"}[5m])) by (destination_version, le))",
            "legendFormat": "P95 {{destination_version}}"
          }
        ]
      }
    ]
  }
}

#!/bin/bash
# deployment-monitor.sh

PROMETHEUS_URL="http://prometheus:9090"
ALERT_WEBHOOK="https://hooks.slack.com/your/webhook"

monitor_deployment() {
    local service_name=$1
    local error_threshold=${2:-0.05}
    local latency_threshold=${3:-2000}

    # Check error rate
    error_rate=$(curl -s "${PROMETHEUS_URL}/api/v1/query?query=sum(rate(istio_requests_total{destination_service_name=\"${service_name}\",response_code!~\"2.*\"}[5m]))/sum(rate(istio_requests_total{destination_service_name=\"${service_name}\"}[5m]))" | jq -r '.data.result[0].value[1] // 0')

    # Check P95 latency
    p95_latency=$(curl -s "${PROMETHEUS_URL}/api/v1/query?query=histogram_quantile(0.95,sum(rate(istio_request_duration_milliseconds_bucket{destination_service_name=\"${service_name}\"}[5m]))by(le))" | jq -r '.data.result[0].value[1] // 0')

    # Alert if thresholds exceeded
    if (( $(echo "$error_rate > $error_threshold" | bc -l) )); then
        send_alert "High error rate detected: $error_rate for $service_name"
        return 1
    fi

    if (( $(echo "$p95_latency > $latency_threshold" | bc -l) )); then
        send_alert "High latency detected: ${p95_latency}ms P95 for $service_name"
        return 1
    fi

    return 0
}

send_alert() {
    local message=$1
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"🚨 Deployment Alert: $message\"}" \
        "$ALERT_WEBHOOK"
}

# Monitor every 30 seconds
while true; do
    monitor_deployment "productpage"
    sleep 30
done

#!/bin/bash
# auto-rollback.sh

PROMETHEUS_URL="http://prometheus:9090"
SERVICE_NAME="productpage"
ERROR_THRESHOLD=0.05
LATENCY_THRESHOLD=2000
CHECK_DURATION=300  # 5 minutes

perform_rollback() {
    echo "Performing automatic rollback for $SERVICE_NAME"

    # Get current virtual service
    CURRENT_VS=$(kubectl get virtualservice ${SERVICE_NAME}-canary -o yaml)

    # Reset to 100% stable version
    kubectl patch virtualservice ${SERVICE_NAME}-canary --type='json' -p='[
      {"op": "replace", "path": "/spec/http/1/route/0/weight", "value": 100},
      {"op": "replace", "path": "/spec/http/1/route/1/weight", "value": 0}
    ]'

    # Scale down canary deployment
    kubectl scale deployment ${SERVICE_NAME}-v2 --replicas=0

    echo "Rollback completed successfully"

    # Send notification
    send_notification "Automatic rollback performed for $SERVICE_NAME due to metric threshold violation"
}

check_deployment_health() {
    # Query error rate
    error_rate=$(curl -s "${PROMETHEUS_URL}/api/v1/query?query=sum(rate(istio_requests_total{destination_service_name=\"${SERVICE_NAME}\",response_code!~\"2.*\"}[5m]))/sum(rate(istio_requests_total{destination_service_name=\"${SERVICE_NAME}\"}[5m]))" | jq -r '.data.result[0].value[1] // 0')

    # Query P95 latency
    p95_latency=$(curl -s "${PROMETHEUS_URL}/api/v1/query?query=histogram_quantile(0.95,sum(rate(istio_request_duration_milliseconds_bucket{destination_service_name=\"${SERVICE_NAME}\"}[5m]))by(le))" | jq -r '.data.result[0].value[1] // 0')

    # Check thresholds
    if (( $(echo "$error_rate > $ERROR_THRESHOLD" | bc -l) )) || (( $(echo "$p95_latency > $LATENCY_THRESHOLD" | bc -l) )); then
        echo "Health check failed: Error rate=$error_rate, P95 latency=${p95_latency}ms"
        return 1
    fi

    return 0
}

# Monitor deployment for specified duration
start_time=$(date +%s)
while [ $(($(date +%s) - start_time)) -lt $CHECK_DURATION ]; do
    if ! check_deployment_health; then
        perform_rollback
        exit 1
    fi
    sleep 30
done

echo "Deployment monitoring completed successfully"

# argocd-rollback.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: productpage-rollout
spec:
  replicas: 5
  strategy:
    canary:
      steps:
      - setWeight: 10
      - pause:
          duration: 300s
      - setWeight: 25
      - pause:
          duration: 300s
      - setWeight: 50
      - pause:
          duration: 300s
      - setWeight: 75
      - pause:
          duration: 300s
      canaryService: productpage-canary
      stableService: productpage
      trafficRouting:
        istio:
          virtualService:
            name: productpage-rollout
          destinationRule:
            name: productpage-rollout
            canarySubsetName: canary
            stableSubsetName: stable
      analysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: productpage
        startingStep: 2
        interval: 60s
        count: 5
        successCondition: result[0] >= 0.95
        failureLimit: 3
  selector:
    matchLabels:
      app: productpage
  template:
    metadata:
      labels:
        app: productpage
    spec:
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v1:1.17.0
        ports:
        - containerPort: 9080
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  args:
  - name: service-name
  metrics:
  - name: success-rate
    interval: 60s
    count: 5
    successCondition: result[0] >= 0.95
    failureLimit: 3
    provider:
      prometheus:
        address: http://prometheus.istio-system:9090
        query: |
          sum(rate(
            istio_requests_total{
              destination_service_name="{{args.service-name}}",
              response_code!~"5.*"
            }[2m]
          )) / 
          sum(rate(
            istio_requests_total{
              destination_service_name="{{args.service-name}}"
            }[2m]
          ))

# resource-management.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-optimized
spec:
  template:
    spec:
      containers:
      - name: productpage
        resources:
          requests:
            memory: "256Mi"
            cpu: "200m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        env:
        - name: JAVA_OPTS
          value: "-Xms256m -Xmx256m"
      - name: istio-proxy
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
      nodeSelector:
        workload-type: "web-app"
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - productpage
              topologyKey: kubernetes.io/hostname

# security-policies.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage-mtls
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: productpage-authz
spec:
  selector:
    matchLabels:
      app: productpage
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/bookinfo-reviews"]
    to:
    - operation:
        methods: ["GET"]
  - from:
    - source:
        namespaces: ["istio-system"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/health", "/metrics"]
---
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: productpage-sidecar
spec:
  workloadSelector:
    labels:
      app: productpage
  egress:
  - hosts:
    - "./*"
    - "istio-system/*"

# performance-optimization.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-performance
  namespace: istio-system
data:
  mesh: |
    defaultConfig:
      concurrency: 2
      proxyStatsMatcher:
        exclusionRegexps:
        - ".*_cx_.*"
      holdApplicationUntilProxyStarts: true
    defaultProviders:
      metrics:
      - prometheus
    extensionProviders:
    - name: prometheus
      prometheus:
        configOverride:
          metric_relabeling_configs:
          - source_labels: [__name__]
            regex: 'istio_build|pilot_k8s_cfg_events'
            action: drop

# load-test.py
import asyncio
import aiohttp
import time
import json
from datetime import datetime

class DeploymentLoadTester:
    def __init__(self, base_url, concurrent_users=50):
        self.base_url = base_url
        self.concurrent_users = concurrent_users
        self.results = []
        self.errors = []

    async def make_request(self, session, url):
        start_time = time.time()
        try:
            async with session.get(url, timeout=10) as response:
                end_time = time.time()
                return {
                    'timestamp': datetime.now().isoformat(),
                    'status_code': response.status,
                    'response_time': end_time - start_time,
                    'success': 200 <= response.status < 300
                }
        except Exception as e:
            end_time = time.time()
            return {
                'timestamp': datetime.now().isoformat(),
                'status_code': 0,
                'response_time': end_time - start_time,
                'success': False,
                'error': str(e)
            }

    async def user_session(self, session, user_id):
        """Simulate a user session with multiple requests"""
        for i in range(100):  # 100 requests per user
            result = await self.make_request(session, f"{self.base_url}/productpage")
            self.results.append(result)

            if not result['success']:
                self.errors.append(result)

            await asyncio.sleep(0.1)  # 100ms between requests

    async def run_load_test(self, duration_minutes=10):
        """Run load test for specified duration"""
        connector = aiohttp.TCPConnector(limit=200)
        timeout = aiohttp.ClientTimeout(total=10)

        async with aiohttp.ClientSession(connector=connector, timeout=timeout) as session:
            # Create tasks for concurrent users
            tasks = []
            for user_id in range(self.concurrent_users):
                task = asyncio.create_task(self.user_session(session, user_id))
                tasks.append(task)

            # Run for specified duration
            await asyncio.sleep(duration_minutes * 60)

            # Cancel remaining tasks
            for task in tasks:
                task.cancel()

            await asyncio.gather(*tasks, return_exceptions=True)

    def generate_report(self):
        """Generate load test report"""
        if not self.results:
            return "No results to report"

        total_requests = len(self.results)
        successful_requests = len([r for r in self.results if r['success']])
        error_rate = (total_requests - successful_requests) / total_requests

        response_times = [r['response_time'] for r in self.results if r['success']]
        if response_times:
            avg_response_time = sum(response_times) / len(response_times)
            p95_response_time = sorted(response_times)[int(len(response_times) * 0.95)]
        else:
            avg_response_time = 0
            p95_response_time = 0

        return {
            'total_requests': total_requests,
            'successful_requests': successful_requests,
            'error_rate': error_rate,
            'avg_response_time': avg_response_time,
            'p95_response_time': p95_response_time,
            'errors': self.errors[:10]  # First 10 errors
        }

# Usage example
async def main():
    tester = DeploymentLoadTester("http://your-ingress-gateway")
    await tester.run_load_test(duration_minutes=5)
    report = tester.generate_report()
    print(json.dumps(report, indent=2))

if __name__ == "__main__":
    asyncio.run(main())

# chaos-experiment.yaml
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: deployment-chaos
spec:
  action: pod-kill
  mode: fixed-percent
  value: "20"
  duration: "30s"
  selector:
    namespaces:
      - default
    labelSelectors:
      app: productpage
  scheduler:
    cron: "@every 2m"
---
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: network-delay-chaos
spec:
  action: delay
  mode: all
  selector:
    namespaces:
      - default
    labelSelectors:
      app: productpage
  delay:
    latency: "100ms"
    correlation: "100"
    jitter: "0ms"
  duration: "60s"

#!/bin/bash
# debug-connection-draining.sh

check_connection_draining() {
    local pod_name=$1

    echo "Checking connection draining for pod: $pod_name"

    # Check pod termination grace period
    grace_period=$(kubectl get pod $pod_name -o jsonpath='{.spec.terminationGracePeriodSeconds}')
    echo "Termination grace period: ${grace_period}s"

    # Check active connections
    kubectl exec $pod_name -c istio-proxy -- ss -tuln

    # Check Envoy admin stats
    kubectl exec $pod_name -c istio-proxy -- curl localhost:15000/stats | grep -E "(cx_active|cx_destroy)"

    # Check for connection draining configuration
    kubectl exec $pod_name -c istio-proxy -- curl localhost:15000/config_dump | jq '.configs[] | select(.["@type"] | contains("Listener"))'
}

monitor_pod_termination() {
    local pod_name=$1

    echo "Monitoring termination of pod: $pod_name"

    # Watch pod events
    kubectl get events --field-selector involvedObject.name=$pod_name -w &
    EVENTS_PID=$!

    # Monitor connection count
    while kubectl get pod $pod_name &>/dev/null; do
        connections=$(kubectl exec $pod_name -c istio-proxy -- ss -tuln | wc -l)
        echo "$(date): Active connections: $connections"
        sleep 5
    done

    kill $EVENTS_PID
}

#!/bin/bash
# debug-traffic-routing.sh

debug_istio_routing() {
    local service_name=$1

    echo "=== Virtual Services ==="
    kubectl get virtualservice -o yaml | grep -A 20 -B 5 $service_name

    echo "=== Destination Rules ==="
    kubectl get destinationrule -o yaml | grep -A 20 -B 5 $service_name

    echo "=== Service Endpoints ==="
    kubectl get endpoints $service_name -o yaml

    echo "=== Pod Labels ==="
    kubectl get pods -l app=$service_name --show-labels

    echo "=== Envoy Configuration ==="
    local pod=$(kubectl get pods -l app=$service_name -o jsonpath='{.items[0].metadata.name}')
    kubectl exec $pod -c istio-proxy -- curl localhost:15000/config_dump > envoy-config.json

    echo "=== Checking Route Configuration ==="
    jq '.configs[] | select(.["@type"] | contains("RouteConfiguration"))' envoy-config.json
}

test_traffic_distribution() {
    local service_url=$1
    local test_count=${2:-100}

    echo "Testing traffic distribution with $test_count requests"

    declare -A version_counts

    for i in $(seq 1 $test_count); do
        version=$(curl -s $service_url | grep -o 'version.*' | head -1 || echo "unknown")
        version_counts[$version]=$((${version_counts[$version]} + 1))
    done

    echo "Traffic distribution:"
    for version in "${!version_counts[@]}"; do
        percentage=$((version_counts[$version] * 100 / test_count))
        echo "$version: ${version_counts[$version]} requests (${percentage}%)"
    done
}

#!/bin/bash
# debug-performance.sh

collect_performance_metrics() {
    local namespace=${1:-default}
    local service_name=$2

    echo "Collecting performance metrics for $service_name"

    # CPU and Memory usage
    echo "=== Resource Usage ==="
    kubectl top pods -n $namespace -l app=$service_name

    # Envoy proxy stats
    echo "=== Envoy Proxy Stats ==="
    local pod=$(kubectl get pods -n $namespace -l app=$service_name -o jsonpath='{.items[0].metadata.name}')
    kubectl exec -n $namespace $pod -c istio-proxy -- curl localhost:15000/stats | grep -E "(response_time|cx_|rq_)"

    # Istio metrics from Prometheus
    echo "=== Istio Metrics ==="
    curl -s "http://prometheus:9090/api/v1/query?query=histogram_quantile(0.95,sum(rate(istio_request_duration_milliseconds_bucket{destination_service_name=\"$service_name\"}[5m]))by(le))"

    # Application metrics
    echo "=== Application Metrics ==="
    kubectl exec -n $namespace $pod -- curl localhost:8080/metrics 2>/dev/null || echo "No application metrics available"
}

analyze_request_flow() {
    local trace_id=$1

    echo "Analyzing request flow for trace: $trace_id"

    # Query Jaeger for trace details
    curl -s "http://jaeger-query:16686/api/traces/$trace_id" | jq '.data[0].spans[] | {operationName, duration, tags}'
}

# multi-cluster-deployment.yaml
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: cross-cluster-gateway
spec:
  selector:
    istio: eastwestgateway
  servers:
  - port:
      number: 15443
      name: tls
      protocol: TLS
    tls:
      mode: ISTIO_MUTUAL
    hosts:
    - "*.local"
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: cross-cluster-productpage
spec:
  host: productpage.default.global
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
  subsets:
  - name: cluster-1
    labels:
      cluster: cluster-1
  - name: cluster-2
    labels:
      cluster: cluster-2
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: cross-cluster-routing
spec:
  hosts:
  - productpage.default.global
  http:
  - match:
    - headers:
        cluster-preference:
          exact: "cluster-2"
    route:
    - destination:
        host: productpage.default.global
        subset: cluster-2
  - route:
    - destination:
        host: productpage.default.global
        subset: cluster-1
      weight: 80
    - destination:
        host: productpage.default.global
        subset: cluster-2
      weight: 20

# ml-deployment-advisor.py
import numpy as np
from sklearn.ensemble import RandomForestClassifier
from sklearn.preprocessing import StandardScaler
import joblib
import requests

class DeploymentAdvisor:
    def __init__(self, model_path=None):
        if model_path:
            self.model = joblib.load(model_path)
            self.scaler = joblib.load(f"{model_path}_scaler.pkl")
        else:
            self.model = RandomForestClassifier(n_estimators=100)
            self.scaler = StandardScaler()
            self.is_trained = False

    def collect_metrics(self, service_name, duration_minutes=5):
        """Collect deployment metrics from Prometheus"""
        metrics = {}

        # Error rate
        query = f'sum(rate(istio_requests_total{{destination_service_name="{service_name}",response_code!~"2.*"}}[{duration_minutes}m]))/sum(rate(istio_requests_total{{destination_service_name="{service_name}"}}[{duration_minutes}m]))'
        result = requests.get(f"http://prometheus:9090/api/v1/query?query={query}")
        metrics['error_rate'] = float(result.json()['data']['result'][0]['value'][1]) if result.json()['data']['result'] else 0

        # P95 latency
        query = f'histogram_quantile(0.95,sum(rate(istio_request_duration_milliseconds_bucket{{destination_service_name="{service_name}"}}[{duration_minutes}m]))by(le))'
        result = requests.get(f"http://prometheus:9090/api/v1/query?query={query}")
        metrics['p95_latency'] = float(result.json()['data']['result'][0]['value'][1]) if result.json()['data']['result'] else 0

        # CPU usage
        query = f'sum(rate(container_cpu_usage_seconds_total{{pod=~"{service_name}.*"}}[{duration_minutes}m]))'
        result = requests.get(f"http://prometheus:9090/api/v1/query?query={query}")
        metrics['cpu_usage'] = float(result.json()['data']['result'][0]['value'][1]) if result.json()['data']['result'] else 0

        # Memory usage
        query = f'sum(container_memory_working_set_bytes{{pod=~"{service_name}.*"}})'
        result = requests.get(f"http://prometheus:9090/api/v1/query?query={query}")
        metrics['memory_usage'] = float(result.json()['data']['result'][0]['value'][1]) if result.json()['data']['result'] else 0

        return metrics

    def should_proceed_with_canary(self, service_name, current_weight):
        """Decide whether to proceed with canary deployment"""
        metrics = self.collect_metrics(service_name)

        features = np.array([
            metrics['error_rate'],
            metrics['p95_latency'],
            metrics['cpu_usage'],
            metrics['memory_usage'],
            current_weight
        ]).reshape(1, -1)

        if hasattr(self, 'is_trained') and not self.is_trained:
            # Default conservative approach
            return metrics['error_rate'] < 0.01 and metrics['p95_latency'] < 1000

        scaled_features = self.scaler.transform(features)
        probability = self.model.predict_proba(scaled_features)[0][1]  # Probability of success

        return probability > 0.8  # 80% confidence threshold

    def recommend_canary_weight(self, service_name, current_weight):
        """Recommend next canary weight"""
        metrics = self.collect_metrics(service_name)

        # Conservative progression based on current health
        if metrics['error_rate'] > 0.02:
            return max(0, current_weight - 10)  # Reduce traffic
        elif metrics['error_rate'] < 0.005 and metrics['p95_latency'] < 500:
            return min(100, current_weight + 20)  # Aggressive progression
        else:
            return min(100, current_weight + 10)  # Normal progression

Internet → Router → Switch → Raspberry Pis
                  ↓
            Your Development Machine

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install essential tools
sudo apt install -y curl wget git vim htop

# Set up static IP (edit netplan configuration)
sudo nano /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 192.168.1.100/24  # Change per node
      gateway4: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

sudo netplan apply
sudo reboot

# Enable cgroup memory and cpu
sudo nano /boot/firmware/cmdline.txt
# Add: cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory

# Disable swap (Kubernetes requirement)
sudo dphys-swapfile swapoff
sudo dphys-swapfile uninstall
sudo update-rc.d dphys-swapfile remove

# Load required kernel modules
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# Configure sysctl parameters
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

sudo sysctl --system
sudo reboot

# Add Docker's official GPG key and repository
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

echo "deb [arch=arm64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install containerd
sudo apt update
sudo apt install -y containerd.io

# Configure containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml

# Enable SystemdCgroup (required for Kubernetes)
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

# Restart and enable containerd
sudo systemctl restart containerd
sudo systemctl enable containerd

sudo systemctl status containerd
sudo ctr version

# Add Kubernetes signing key
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

# Add Kubernetes repository
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

# Install Kubernetes components
sudo apt update
sudo apt install -y kubelet kubeadm kubectl

# Hold packages to prevent automatic updates
sudo apt-mark hold kubelet kubeadm kubectl

sudo kubeadm init \
  --apiserver-advertise-address=192.168.1.100 \
  --pod-network-cidr=10.244.0.0/16 \
  --service-cidr=10.96.0.0/12

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

kubectl get nodes
kubectl get pods --all-namespaces

# Download Flannel manifest
curl -sSL https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml -o kube-flannel.yml

# Apply Flannel configuration
kubectl apply -f kube-flannel.yml

# Verify Flannel pods are running
kubectl get pods -n kube-flannel

sudo kubeadm join 192.168.1.100:6443 --token <token> \
    --discovery-token-ca-cert-hash sha256:<hash>

kubeadm token create --print-join-command

kubectl get nodes
kubectl get pods --all-namespaces

kubectl describe node <node-name>
journalctl -u kubelet -f

# local-storage.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-storage
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

kubectl apply -f local-storage.yaml
kubectl get storageclass

# local-pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: local-pv-1
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: local-storage
  local:
    path: /mnt/local-storage
  nodeAffinity:
    required:
      nodeSelectorTerms:
      - matchExpressions:
        - key: kubernetes.io/hostname
          operator: In
          values:
          - pi-worker-1

# nginx-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: ClusterIP

kubectl apply -f nginx-deployment.yaml
kubectl get deployments
kubectl get pods -o wide
kubectl get services

kubectl run test-pod --image=busybox --rm -it --restart=Never -- sh

# Inside the test pod:
wget -qO- http://nginx-service
exit

# Download metrics-server manifest
curl -sSL https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -o metrics-server.yaml

# Edit to add --kubelet-insecure-tls flag for self-signed certificates
kubectl apply -f metrics-server.yaml

# Verify installation
kubectl get pods -n kube-system | grep metrics-server
kubectl top nodes
kubectl top pods

# Node resource usage
kubectl top nodes

# Pod resource usage across all namespaces
kubectl top pods --all-namespaces

# Cluster events
kubectl get events --sort-by='.lastTimestamp'

# Service status
kubectl get all --all-namespaces

# Deploy dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml

# Create admin user
kubectl create serviceaccount dashboard-admin-sa
kubectl create clusterrolebinding dashboard-admin-sa --clusterrole=cluster-admin --serviceaccount=default:dashboard-admin-sa

# Get access token
kubectl create token dashboard-admin-sa

# Port forward to access dashboard
kubectl proxy --address='0.0.0.0' --accept-hosts='^*$'

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
helm version

# Check node status
kubectl describe node <node-name>

# Check kubelet logs
sudo journalctl -u kubelet -f

# Common fixes
sudo systemctl restart kubelet
sudo systemctl restart containerd

# Check resource constraints
kubectl describe pod <pod-name>

# View node resources
kubectl describe nodes

# Check for taints
kubectl get nodes -o json | jq '.items[].spec.taints'

# Verify Flannel is running
kubectl get pods -n kube-flannel

# Check pod network connectivity
kubectl exec -it <pod-name> -- ping <another-pod-ip>

# Restart networking
kubectl delete pods -n kube-flannel --all

# Monitor resource usage
kubectl top nodes
kubectl top pods --all-namespaces

# Check for thermal throttling
vcgencmd measure_temp
vcgencmd get_throttled

# Update RBAC permissions (remove default permissions)
kubectl delete clusterrolebinding cluster-admin

# Create limited service accounts
kubectl create serviceaccount limited-user
kubectl create rolebinding limited-user --clusterrole=view --serviceaccount=default:limited-user

# Example Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

# Update system packages (monthly)
sudo apt update && sudo apt upgrade -y

# Clean up unused images
sudo crictl rmi --prune

# Check cluster health
kubectl get componentstatuses
kubectl get nodes
kubectl get pods --all-namespaces

# Check current version
kubectl version

# Plan upgrade
sudo kubeadm upgrade plan

# Upgrade master node
sudo kubeadm upgrade apply v1.28.x

# Upgrade worker nodes
sudo kubeadm upgrade node
sudo systemctl restart kubelet

version: '3'
services:
  prometheus:
    image: prom/prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"
  grafana:
    image: grafana/grafana
    ports:
      - "3000:3000"

global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

docker-compose up -d

npm install express express-prometheus-middleware

const express = require('express');
const prometheus = require('express-prometheus-middleware');
const app = express();

app.use(prometheus({ metricsPath: '/metrics' }));

app.get('/', (req, res) => res.send('Hello World!'));

app.listen(3001, () => console.log('Running on 3001'));

  - job_name: 'node-app'
    static_configs:
      - targets: ['host.docker.internal:3001']

groups:
  - name: example
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status="500"}[5m]) > 0
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "High error rate detected"

rule_files:
  - "alert.rules.yml"

pipeline {
    agent any

    environment {
        PYTHON_VERSION = "3.9"
        VIRTUAL_ENV = "venv"
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Setup Environment') {
            steps {
                sh '''
                    python${PYTHON_VERSION} -m venv ${VIRTUAL_ENV}
                    source ${VIRTUAL_ENV}/bin/activate
                    pip install --upgrade pip
                '''
            }
        }

        stage('Install Dependencies') {
            steps {
                sh '''
                    source ${VIRTUAL_ENV}/bin/activate
                    pip install -r requirements.txt
                '''
            }
        }

        stage('Test') {
            steps {
                sh '''
                    source ${VIRTUAL_ENV}/bin/activate
                    python -m pytest tests/ --junitxml=test-results.xml
                '''
            }
        }

        stage('Deploy') {
            steps {
                echo 'Deploying application...'
            }
        }
    }

    post {
        always {
            cleanWs()
        }
    }
}

stage('Setup Virtual Environment') {
    steps {
        script {
            if (isUnix()) {
                sh '''
                    python3 -m venv venv
                    source venv/bin/activate
                    pip install --upgrade pip setuptools wheel
                '''
            } else {
                bat '''
                    python -m venv venv
                    call venv\\Scripts\\activate.bat
                    pip install --upgrade pip setuptools wheel
                '''
            }
        }
    }
}

stage('Install Dependencies') {
    steps {
        script {
            def requirements = [
                'requirements.txt',
                'requirements-dev.txt',
                'requirements-test.txt'
            ]

            for (req in requirements) {
                if (fileExists(req)) {
                    sh """
                        source venv/bin/activate
                        pip install -r ${req}
                    """
                }
            }
        }
    }
}

environment {
    DATABASE_URL = credentials('database-url')
    API_KEY = credentials('api-key')
    FLASK_ENV = 'testing'
    PYTHONPATH = "${WORKSPACE}"
}

stage('Unit Tests') {
    steps {
        sh '''
            source venv/bin/activate
            python -m pytest tests/unit/ \
                --junitxml=reports/unit-test-results.xml \
                --cov=src \
                --cov-report=xml:reports/coverage.xml \
                --cov-report=html:reports/coverage-html
        '''
    }
    post {
        always {
            junit 'reports/unit-test-results.xml'
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: 'reports/coverage-html',
                reportFiles: 'index.html',
                reportName: 'Coverage Report'
            ])
        }
    }
}

stage('Integration Tests') {
    steps {
        sh '''
            source venv/bin/activate
            # Start test database or services
            docker-compose -f docker-compose.test.yml up -d

            # Wait for services to be ready
            sleep 30

            # Run integration tests
            python -m pytest tests/integration/ \
                --junitxml=reports/integration-test-results.xml
        '''
    }
    post {
        always {
            sh 'docker-compose -f docker-compose.test.yml down'
            junit 'reports/integration-test-results.xml'
        }
    }
}

stage('Code Quality') {
    parallel {
        stage('Lint') {
            steps {
                sh '''
                    source venv/bin/activate
                    flake8 src/ tests/ --output-file=reports/flake8-report.txt
                    pylint src/ --output-format=parseable --reports=no > reports/pylint-report.txt || true
                '''
            }
        }

        stage('Type Checking') {
            steps {
                sh '''
                    source venv/bin/activate
                    mypy src/ --junit-xml reports/mypy-report.xml || true
                '''
            }
        }

        stage('Security Scan') {
            steps {
                sh '''
                    source venv/bin/activate
                    bandit -r src/ -f json -o reports/bandit-report.json || true
                '''
            }
        }
    }
}

stage('Security Scan') {
    steps {
        sh '''
            source venv/bin/activate
            # Check for known vulnerabilities
            safety check --json --output reports/safety-report.json || true

            # License compliance check
            pip-licenses --format=json --output-file=reports/licenses.json
        '''
    }
    post {
        always {
            archiveArtifacts artifacts: 'reports/safety-report.json', allowEmptyArchive: true
            archiveArtifacts artifacts: 'reports/licenses.json', allowEmptyArchive: true
        }
    }
}

stage('Build Package') {
    steps {
        sh '''
            source venv/bin/activate
            python setup.py sdist bdist_wheel

            # Verify the package
            twine check dist/*
        '''
    }
    post {
        success {
            archiveArtifacts artifacts: 'dist/*', fingerprint: true
        }
    }
}

stage('Build Docker Image') {
    steps {
        script {
            def image = docker.build("myapp:${env.BUILD_NUMBER}")

            // Tag with latest if on main branch
            if (env.BRANCH_NAME == 'main') {
                image.tag('latest')
            }

            // Push to registry
            docker.withRegistry('https://registry.example.com', 'registry-credentials') {
                image.push("${env.BUILD_NUMBER}")
                if (env.BRANCH_NAME == 'main') {
                    image.push('latest')
                }
            }
        }
    }
}

stage('Blue-Green Deploy') {
    when {
        branch 'main'
    }
    steps {
        script {
            // Deploy to green environment
            sh '''
                kubectl set image deployment/myapp-green \
                    myapp=registry.example.com/myapp:${BUILD_NUMBER} \
                    --namespace=production

                # Wait for rollout
                kubectl rollout status deployment/myapp-green --namespace=production
            '''

            // Health check
            def healthCheck = sh(
                script: "curl -f http://green.myapp.com/health",
                returnStatus: true
            )

            if (healthCheck == 0) {
                // Switch traffic
                sh '''
                    kubectl patch service myapp-service \
                        -p '{"spec":{"selector":{"version":"green"}}}' \
                        --namespace=production
                '''
            } else {
                error "Health check failed on green environment"
            }
        }
    }
}

stage('Canary Deploy') {
    steps {
        script {
            // Deploy to 10% of traffic
            sh '''
                kubectl patch deployment myapp-canary \
                    -p '{"spec":{"template":{"spec":{"containers":[{"name":"myapp","image":"registry.example.com/myapp:${BUILD_NUMBER}"}]}}}}' \
                    --namespace=production

                kubectl scale deployment myapp-canary --replicas=1 --namespace=production
            '''

            // Monitor metrics for 5 minutes
            sleep(300)

            // Check error rate
            def errorRate = sh(
                script: "curl -s http://monitoring.example.com/api/error-rate",
                returnStdout: true
            ).trim() as Double

            if (errorRate < 0.01) {
                // Promote to full deployment
                sh '''
                    kubectl set image deployment/myapp \
                        myapp=registry.example.com/myapp:${BUILD_NUMBER} \
                        --namespace=production
                '''
            } else {
                error "Error rate too high: ${errorRate}"
            }
        }
    }
}

pipeline {
    agent none

    stages {
        stage('Test Matrix') {
            matrix {
                axes {
                    axis {
                        name 'PYTHON_VERSION'
                        values '3.8', '3.9', '3.10', '3.11'
                    }
                }
                stages {
                    stage('Test') {
                        agent {
                            docker {
                                image "python:${PYTHON_VERSION}"
                            }
                        }
                        steps {
                            sh '''
                                python -m venv venv
                                source venv/bin/activate
                                pip install -r requirements.txt
                                pytest tests/
                            '''
                        }
                    }
                }
            }
        }
    }
}

stage('Parallel Tasks') {
    parallel {
        stage('Unit Tests') {
            steps {
                sh 'python -m pytest tests/unit/'
            }
        }
        stage('Integration Tests') {
            steps {
                sh 'python -m pytest tests/integration/'
            }
        }
        stage('Security Scan') {
            steps {
                sh 'bandit -r src/'
            }
        }
    }
}

stage('Deploy to Production') {
    when {
        allOf {
            branch 'main'
            environment name: 'DEPLOY_PROD', value: 'true'
        }
    }
    steps {
        script {
            timeout(time: 5, unit: 'MINUTES') {
                input message: 'Deploy to production?', ok: 'Deploy'
            }
        }
        sh 'kubectl apply -f k8s/production/'
    }
}

post {
    failure {
        emailext (
            subject: "🚨 Build Failed: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
            body: '''
                Build failed for ${env.JOB_NAME} - ${env.BUILD_NUMBER}

                Check console output: ${env.BUILD_URL}console

                Changes:
                ${env.CHANGE_LOG}
            ''',
            to: "${env.CHANGE_AUTHOR_EMAIL}",
            cc: 'team@example.com'
        )
    }

    success {
        emailext (
            subject: "✅ Build Successful: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
            body: "Build completed successfully for ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
            to: "${env.CHANGE_AUTHOR_EMAIL}"
        )
    }
}

stage('Cache Dependencies') {
    steps {
        script {
            def cacheKey = sh(
                script: "md5sum requirements.txt",
                returnStdout: true
            ).trim()

            if (fileExists("cache/${cacheKey}")) {
                sh "cp -r cache/${cacheKey} venv"
            } else {
                sh "pip install -r requirements.txt"
                sh "mkdir -p cache && cp -r venv cache/${cacheKey}"
            }
        }
    }
}

pipeline {
    agent any

    environment {
        PYTHON_VERSION = "3.9"
        VIRTUAL_ENV = "venv"
        REGISTRY = "registry.example.com"
        APP_NAME = "myapp"
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Setup Environment') {
            steps {
                sh '''
                    python${PYTHON_VERSION} -m venv ${VIRTUAL_ENV}
                    source ${VIRTUAL_ENV}/bin/activate
                    pip install --upgrade pip setuptools wheel
                '''
            }
        }

        stage('Install Dependencies') {
            steps {
                sh '''
                    source ${VIRTUAL_ENV}/bin/activate
                    pip install -r requirements.txt
                    pip install -r requirements-dev.txt
                '''
            }
        }

        stage('Quality & Security') {
            parallel {
                stage('Unit Tests') {
                    steps {
                        sh '''
                            source ${VIRTUAL_ENV}/bin/activate
                            python -m pytest tests/unit/ \
                                --junitxml=reports/unit-tests.xml \
                                --cov=src \
                                --cov-report=xml:reports/coverage.xml
                        '''
                    }
                }

                stage('Integration Tests') {
                    steps {
                        sh '''
                            source ${VIRTUAL_ENV}/bin/activate
                            python -m pytest tests/integration/ \
                                --junitxml=reports/integration-tests.xml
                        '''
                    }
                }

                stage('Code Quality') {
                    steps {
                        sh '''
                            source ${VIRTUAL_ENV}/bin/activate
                            flake8 src/ tests/
                            pylint src/
                            mypy src/
                        '''
                    }
                }

                stage('Security Scan') {
                    steps {
                        sh '''
                            source ${VIRTUAL_ENV}/bin/activate
                            bandit -r src/
                            safety check
                        '''
                    }
                }
            }
        }

        stage('Build') {
            steps {
                sh '''
                    source ${VIRTUAL_ENV}/bin/activate
                    python setup.py sdist bdist_wheel
                '''

                script {
                    def image = docker.build("${REGISTRY}/${APP_NAME}:${env.BUILD_NUMBER}")

                    if (env.BRANCH_NAME == 'main') {
                        image.tag('latest')
                    }

                    docker.withRegistry("https://${REGISTRY}", 'registry-credentials') {
                        image.push("${env.BUILD_NUMBER}")
                        if (env.BRANCH_NAME == 'main') {
                            image.push('latest')
                        }
                    }
                }
            }
        }

        stage('Deploy') {
            when {
                branch 'main'
            }
            steps {
                script {
                    // Deploy to staging first
                    sh '''
                        kubectl set image deployment/${APP_NAME} \
                            ${APP_NAME}=${REGISTRY}/${APP_NAME}:${BUILD_NUMBER} \
                            --namespace=staging

                        kubectl rollout status deployment/${APP_NAME} --namespace=staging
                    '''

                    // Health check
                    def healthCheck = sh(
                        script: "curl -f http://staging.${APP_NAME}.com/health",
                        returnStatus: true
                    )

                    if (healthCheck == 0) {
                        // Manual approval for production
                        timeout(time: 10, unit: 'MINUTES') {
                            input message: 'Deploy to production?', ok: 'Deploy'
                        }

                        // Deploy to production
                        sh '''
                            kubectl set image deployment/${APP_NAME} \
                                ${APP_NAME}=${REGISTRY}/${APP_NAME}:${BUILD_NUMBER} \
                                --namespace=production

                            kubectl rollout status deployment/${APP_NAME} --namespace=production
                        '''
                    } else {
                        error "Staging health check failed"
                    }
                }
            }
        }
    }

    post {
        always {
            junit 'reports/*.xml'
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: 'reports',
                reportFiles: 'coverage.xml',
                reportName: 'Coverage Report'
            ])
            archiveArtifacts artifacts: 'dist/*', fingerprint: true
            cleanWs()
        }

        failure {
            emailext (
                subject: "🚨 Build Failed: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
                body: "Build failed. Check: ${env.BUILD_URL}console",
                to: "${env.CHANGE_AUTHOR_EMAIL}"
            )
        }

        success {
            emailext (
                subject: "✅ Build Successful: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
                body: "Build completed successfully!",
                to: "${env.CHANGE_AUTHOR_EMAIL}"
            )
        }
    }
}

# Fix permission issues
sudo chown -R jenkins:jenkins /var/lib/jenkins/workspace/

# Clear pip cache
pip cache purge

# Clean docker system
docker system prune -f

# Check disk space
df -h

# Run tests with verbose output
python -m pytest -v --tb=short

# Check test environment
echo $PYTHONPATH

Persona	Use Case
Plugin/Theme Developers	Rapid iteration, cross-version testing, PR previews
Product Creators	Interactive demos without requiring installation
WordPress Educators	Risk-free learning environments for students
Support Teams	Reproduce user issues in isolated, shareable environments
Contributors	Test core patches and PRs without a local dev setup

Feature	LocalWP / MAMP	WordPress Playground
Setup time	5–20 minutes	< 5 seconds
Requires installation	Yes	No
Works offline	Yes (after setup)	Yes (natively)
Embeddable in a webpage	No	Yes
Shareable environments	Difficult	One URL
Persistent across sessions	Yes	Optional
Full production parity	High	Moderate

Dimension	Containers	Virtual Machines
OS Overhead	Shares host kernel	Full OS per VM
Startup Time	Milliseconds	30s – 2 minutes
Image Size	~22 MB (Ubuntu base)	~2.3 GB (Ubuntu VM)
Portability	Any compatible host OS	Requires matching hypervisor
Isolation Level	Process-level (namespaces)	Full OS isolation
Management	Lightweight, fast-moving	Heavier tooling required

Command	Does What
`docker build`	Reads a Dockerfile and produces an image
`docker run`	Starts a container from an image
`docker push`	Uploads an image to a registry

Step	Action	Command
1	Install PAM module	`sudo apt install libpam-google-authenticator`
2	Configure per user	`google-authenticator`
3	Update PAM	Edit `/etc/pam.d/sshd`
4	Update SSH config	Edit `/etc/ssh/sshd_config`
5	Restart SSH	`sudo systemctl restart ssh`
6	Test connection	Open new SSH session

Forem: Purushotam Adhikari

The Sentient Refusal: A Premium HTCPCP/1.1 Client

What I Built

Demo

Code

How I Built It

Prize Category

The Axios Supply Chain Attack: What You Need to Know (and Do) Right Now

The TL;DR (Action Required)

How the Attack Unfolded

The "Phantom Dependency" Strategy

Multi-Platform Malware

The "Ghost" Cleanup

How to Check if You're Affected

Immediate Remediation Steps

1. Revert and Pin

2. Rotate ALL Secrets

3. Clear Your Caches

Lessons for the Future

WordPress Playground: Run WordPress Instantly in Your Browser — No Setup Required

What Is WordPress Playground?

How Do You Run It?

What Can You Actually Do With It?

Building

Testing & QA

Showcasing & Distributing

The Developer API

Who Is This For?

How It Compares to Traditional Local Dev

Open Source, Community Maintained

Getting Started

Final Thoughts

Docker & Containers: Ground UP

TL;DR

What Is a Container?

Containers vs. Virtual Machines

Why Are Containers So Lightweight?

What a container base image includes:

What it borrows from the host OS:

What Is Docker?

Docker Architecture

The Docker Lifecycle

Key Docker Terminology

Dockerfile

Image

Container

Docker Daemon (dockerd)

Docker Client (docker)

Docker Registry

Installing Docker on Ubuntu

Start the Daemon & Grant User Access

Verify the Installation

Building & Running Your First Image

Step 1: Clone the example repo

Step 2: Log in to DockerHub

Step 3: Build your image

Step 4: Verify the image exists

Step 5: Run the container

Step 6: Push to DockerHub

Key Takeaways

What's Next?

[Boost]

ERC-8128: Your Ethereum Wallet Might Soon Be Your Only Login.

Purushotam Adhikari ・ Feb 22

ERC-8128: Your Ethereum Wallet Might Soon Be Your Only Login.

Enter ERC-8128

What's Actually Broken With How We Do Auth Today

How ERC-8128 Flips the Model

Replay Attacks and Nonces

The Bigger Picture: ERC-8128 + ERC-8004

Where SIWE Falls Short (And Why ERC-8128 Is Different)

What's Still Being Worked Out

My Take

Securing Your Ubuntu Server: SSH Two-Factor Authentication with Google Authenticator

Why SSH 2FA Matters

Prerequisites

Setting Up Your Ubuntu VM

Implementation Steps

Step 1: Install Google Authenticator PAM Module

Step 2: Configure Google Authenticator for Your User

Docker Daemon (`dockerd`)

Docker Client (`docker`)