foxhunt/docs/security/PENETRATION_TEST_PLAN.md

Penetration Testing Plan - Foxhunt HFT Trading System

Date: 2025-10-08 Prepared by: Agent 115 (Security Audit) Test Window: Q4 2025 (November-December) Version: 1.0

---

Executive Summary

This document outlines a comprehensive penetration testing plan for the Foxhunt HFT trading system. The plan covers infrastructure security, application security, authentication/authorization, API security, and compliance validation.

Testing Approach: White-box penetration testing with full system access
Duration: 2-3 weeks
Team Size: 3-4 security engineers
Budget: $50,000-$75,000 (external vendor)

---

1. Testing Scope

In-Scope Systems

1. API Gateway (port 50051)

   • gRPC endpoints
   • Authentication/authorization
   • mTLS enforcement
   • Rate limiting

2. Trading Service (port 50052)

   • Order execution logic
   • Risk management
   • Position management

3. Backtesting Service (port 50053)

   • Strategy execution
   • Market data replay
   • Performance analytics

4. ML Training Service (port 50054)

   • Model training pipeline
   • Feature engineering
   • Model versioning

5. Infrastructure

   • PostgreSQL (TimescaleDB)
   • Redis cache
   • HashiCorp Vault
   • Prometheus/Grafana
   • Docker containers

Out-of-Scope

• Physical security testing
• Social engineering attacks
• Denial of Service (DoS) attacks (could impact production)
• Third-party vendor systems (Databento, Benzinga)

---

2. Test Objectives

Primary Objectives

1. Validate Security Controls:

   • TLS 1.3 enforcement
   • mTLS client certificate validation
   • SQL injection prevention
   • Input validation effectiveness

2. Identify Vulnerabilities:

   • OWASP Top 10 (2021)
   • CWE Top 25 (2023)
   • HFT-specific attack vectors

3. Assess Compliance:

   • SOX audit trail integrity
   • MiFID II transaction reporting
   • GDPR data protection

4. Test Incident Response:

   • Monitoring and alerting
   • Intrusion detection
   • Security team response time

---

3. Test Methodology

Phase 1: Reconnaissance (2-3 days)

Objective: Gather information about the target system

Activities:

1. Network Scanning:

   # Port scanning
   nmap -sV -p- trading.foxhunt.com
   
   # Service enumeration
   nmap -sC -sV -p 50051,50052,50053,50054 trading.foxhunt.com
   
   # SSL/TLS scanning
   testssl.sh trading.foxhunt.com:50051
   

2. DNS Enumeration:

   # DNS records
   dig trading.foxhunt.com ANY
   
   # Subdomain enumeration
   subfinder -d foxhunt.com
   

3. API Documentation Review:

   • Review protobuf definitions
   • Analyze API Gateway endpoints
   • Identify authentication mechanisms

4. Technology Stack Analysis:

   • Rust version and dependencies
   • Database versions (PostgreSQL, Redis)
   • Container orchestration (Docker Compose)

---

Phase 2: Vulnerability Assessment (3-5 days)

Objective: Identify security vulnerabilities

2.1 TLS/SSL Security Testing

Tools: testssl.sh, SSL Labs, nmap
Target: All gRPC services (ports 50051-50054)

Test Cases:

• Weak Cipher Suites:

  testssl.sh --severity HIGH trading.foxhunt.com:50051
  

  • ❌ Check for RC4, 3DES, NULL ciphers
  • ❌ Check for export-grade ciphers
  • ✅ Verify only AEAD ciphers enabled (AES-GCM, ChaCha20)

• Protocol Downgrade:

  openssl s_client -connect trading.foxhunt.com:50051 -tls1_2
  

  • ❌ Should reject TLS 1.2 connections
  • ✅ Only accept TLS 1.3

• Certificate Validation:

  # Test with expired certificate
  openssl s_client -connect trading.foxhunt.com:50051 -cert expired.pem -key expired.key
  
  # Test with self-signed certificate
  openssl s_client -connect trading.foxhunt.com:50051 -cert selfsigned.pem -key selfsigned.key
  
  # Test with wrong CN
  openssl s_client -connect trading.foxhunt.com:50051 -cert wrongcn.pem -key wrongcn.key
  

  • ❌ Should reject expired certificates
  • ❌ Should reject self-signed certificates (if not in CA)
  • ❌ Should reject certificates with wrong CN

• mTLS Enforcement:

  # Test without client certificate
  grpcurl -plaintext trading.foxhunt.com:50051 list
  

  • ❌ Should reject connections without client certificate
  • ✅ Should require valid client certificate

• Certificate Chain Validation:

  • ❌ Test with truncated certificate chain
  • ❌ Test with wrong intermediate CA
  • ✅ Verify complete chain validation

---

2.2 Authentication & Authorization Testing

Tools: Burp Suite, Custom gRPC clients
Target: API Gateway (port 50051)

Test Cases:

• JWT Token Security:

  # Test with expired token
  grpcurl -H "Authorization: Bearer <expired_token>" ...
  
  # Test with tampered token
  grpcurl -H "Authorization: Bearer <tampered_token>" ...
  
  # Test with no signature
  grpcurl -H "Authorization: Bearer <unsigned_token>" ...
  

  • ❌ Should reject expired tokens
  • ❌ Should reject tampered tokens
  • ❌ Should reject unsigned tokens

• MFA Bypass:

  # Test TOTP with wrong code
  # Test TOTP with replay attack (same code twice)
  # Test backup code reuse
  

  • ❌ Should reject wrong TOTP codes
  • ❌ Should reject replayed TOTP codes
  • ❌ Should reject used backup codes

• Session Management:

  • ❌ Test session fixation
  • ❌ Test concurrent session limits
  • ❌ Test session timeout enforcement

• Authorization Bypass (IDOR):

  # Test accessing other user's orders
  grpcurl -H "Authorization: Bearer <user1_token>" \
    -d '{"order_id": "user2_order_id"}' \
    trading.foxhunt.com:50052 CancelOrder
  

  • ❌ Should reject access to other users' resources
  • ✅ Verify RBAC enforcement

• Privilege Escalation:

  • ❌ Test trader accessing admin endpoints
  • ❌ Test role manipulation in JWT
  • ✅ Verify least privilege enforcement

---

2.3 SQL Injection Testing

Tools: SQLMap, Custom test scripts
Target: All database-backed services

Test Cases:

• Classic SQL Injection:

  # Test with malicious input
  grpcurl -d '{"symbol": "AAPL''; DROP TABLE orders; --"}' ...
  

  • ✅ Should prevent injection (parameterized queries)

• Second-Order SQL Injection:

  • Store malicious data in database
  • Trigger execution on retrieval
  • ✅ Should sanitize stored data

• Blind SQL Injection:

  # Time-based blind injection
  grpcurl -d '{"symbol": "AAPL' AND SLEEP(5)--"}' ...
  

  • ✅ Should not allow timing attacks

• ORM Bypass:

  • Test SQLx edge cases
  • Test parameterized query escaping
  • ✅ Verify type safety

Expected Result: ✅ All SQL injection tests should FAIL (system is secure)

---

2.4 Input Validation & Fuzzing

Tools: Radamsa, AFL, Custom fuzzers
Target: All API endpoints

Test Cases:

• gRPC Fuzzing:

  # Fuzz order placement
  for i in {1..10000}; do
    grpcurl -d '{"price": "'$(random_string)'", "quantity": "'$(random_number)'"}' ...
  done
  

  • ❌ Should reject invalid inputs
  • ✅ Should not crash on malformed data

• Boundary Value Testing:

  # Test maximum order size
  grpcurl -d '{"quantity": 9999999999999999}' ...
  
  # Test negative values
  grpcurl -d '{"price": -1000}' ...
  

  • ❌ Should enforce business logic limits
  • ❌ Should reject negative values

• Buffer Overflow Testing:

  # Test with oversized strings
  grpcurl -d '{"symbol": "'$(python -c 'print("A"*10000)')'"}' ...
  

  • ✅ Should handle large inputs gracefully

• Binary Data Parsing (Databento DBN):

  • Fuzz DBN message headers
  • Test with corrupted CRC32 checksums
  • Test with invalid message lengths
  • ✅ Should validate all binary inputs

---

2.5 API Security Testing

Tools: Burp Suite, Postman, Custom clients
Target: API Gateway (port 50051)

Test Cases:

• Rate Limiting:

  # Send 1000 requests in 1 second
  for i in {1..1000}; do
    grpcurl -d '{"symbol": "AAPL"}' trading.foxhunt.com:50052 GetPrice &
  done
  

  • ✅ Should enforce rate limits (429 Too Many Requests)

• GraphQL/gRPC Enumeration:

  # List all available services
  grpcurl trading.foxhunt.com:50051 list
  
  # Describe service methods
  grpcurl trading.foxhunt.com:50051 describe TradingService
  

  • ✅ Should only expose intended APIs
  • ❌ Should not leak internal methods

• API Versioning:

  • Test deprecated API versions
  • Test version downgrade attacks
  • ✅ Verify backward compatibility security

• Content Type Validation:

  • Test with XML injection in gRPC
  • Test with JSON in protobuf fields
  • ✅ Should enforce strict content types

---

Phase 3: Exploitation (5-7 days)

Objective: Attempt to exploit identified vulnerabilities

3.1 Infrastructure Attacks

Test Cases:

• Container Escape:

  # Test Docker breakout
  docker exec -it <container_id> sh
  
  # Test privilege escalation
  cat /proc/1/cgroup
  

  • ✅ Should prevent container escape

• Network Segmentation:

  # Test inter-service communication
  docker exec trading_service ping ml_training_service
  
  # Test external access
  docker exec trading_service curl evil.com
  

  • ✅ Should enforce network policies
  • ❌ Should block external connections (if not required)

• Secret Exposure:

  # Test environment variable leakage
  docker inspect <container_id> | grep -i password
  
  # Test Vault token exposure
  docker exec <container_id> env | grep VAULT_TOKEN
  

  • ✅ Should not expose secrets in environment
  • ✅ Should use Vault for secret management

• Database Access:

  # Test PostgreSQL from trading service
  docker exec trading_service psql -h postgres -U foxhunt
  
  # Test Redis access
  docker exec trading_service redis-cli -h redis
  

  • ✅ Should enforce least privilege
  • ❌ Should not allow direct database access from services

---

3.2 Compliance Validation

Test Cases:

• SOX Audit Trail:

  • Attempt to modify audit logs in TimescaleDB
  • Test hash chain integrity
  • ✅ Should detect tampering

• MiFID II Transaction Reporting:

  • Test T+1 reporting deadline
  • Validate mandatory 65 fields
  • ✅ Should meet regulatory requirements

• GDPR Data Protection:

  • Test PII encryption at rest
  • Test PII encryption in transit
  • Test right to erasure
  • ✅ Should comply with GDPR

---

Phase 4: Post-Exploitation (2-3 days)

Objective: Assess impact and lateral movement

Test Cases:

• Lateral Movement:

  • From trading_service to ml_training_service
  • From api_gateway to backtesting_service
  • ✅ Should prevent lateral movement

• Data Exfiltration:

  • Test large data transfers
  • Test encrypted exfiltration
  • ✅ Should detect and block exfiltration

• Persistence:

  • Test backdoor installation
  • Test cron job creation
  • ✅ Should detect unauthorized changes

---

Phase 5: Reporting (3-5 days)

Objective: Document findings and recommendations

Deliverables:

1. Executive Summary:

   • High-level findings
   • Risk assessment
   • Strategic recommendations

2. Technical Report:

   • Detailed vulnerability descriptions
   • Proof-of-concept exploits
   • CVSS scores
   • Remediation steps

3. Compliance Report:

   • SOX/MiFID II validation results
   • Regulatory gaps
   • Compliance recommendations

4. Remediation Roadmap:

   • Prioritized action items
   • Timeline estimates
   • Resource requirements

---

4. Tools & Environment

Testing Tools

Network Scanning:

• nmap (port scanning, service enumeration)
• testssl.sh (SSL/TLS testing)
• SSLyze (certificate validation)

Application Security:

• Burp Suite Professional (API testing)
• grpcurl (gRPC client)
• Postman (API automation)

Fuzzing:

• Radamsa (input fuzzing)
• AFL (American Fuzzy Lop)
• gRPC-fuzz (custom gRPC fuzzer)

Database Testing:

• SQLMap (SQL injection)
• NoSQLMap (NoSQL injection)
• pgbench (PostgreSQL stress testing)

Infrastructure:

• Docker (container testing)
• Kubernetes (if used)
• Trivy (container vulnerability scanning)

Test Environment

Isolated Test Network:

• Dedicated VPC/subnet
• No production data
• Synthetic test data only

Test Credentials:

• Dedicated test accounts
• Separate from production
• Full access for white-box testing

---

5. Success Criteria

Passing Criteria:

• ✅ Zero critical vulnerabilities
• ✅ Zero high-severity SQL injection vulnerabilities
• ✅ TLS 1.3 enforced (no downgrades)
• ✅ mTLS enforced (100% of inter-service communication)
• ✅ SOX/MiFID II compliance validated
• ✅ All unsafe code blocks justified

Risk Acceptance:

• Medium vulnerabilities with compensating controls
• Low vulnerabilities with documented risk acceptance
• Informational findings for future enhancement

---

6. Timeline & Milestones

Week	Phase	Activities	Deliverable
1	Reconnaissance	Network scanning, API enumeration	Scope document
2-3	Vulnerability Assessment	TLS, auth, SQL injection, API testing	Vulnerability report
4-5	Exploitation	Infrastructure attacks, compliance validation	Exploitation report
6	Post-Exploitation	Lateral movement, data exfiltration	Impact assessment
7	Reporting	Documentation, executive summary	Final report

---

7. Risk Management

Testing Risks:

1. Service Disruption: Fuzzing could crash services

   • Mitigation: Test in isolated environment, gradual rollout

2. Data Corruption: Exploitation could corrupt test data

   • Mitigation: Database backups before testing, synthetic data only

3. False Positives: Tools may report non-vulnerabilities

   • Mitigation: Manual validation of all findings

4. Credential Exposure: Test credentials could be leaked

   • Mitigation: Rotate all credentials after testing

---

8. Vendor Selection Criteria

Required Qualifications:

• CREST/OSCP certified security engineers
• Experience with financial trading systems
• gRPC/Rust expertise
• SOX/MiFID II compliance knowledge
• References from similar projects

Recommended Vendors:

1. Bishop Fox (financial services focus)
2. NCC Group (compliance expertise)
3. Trail of Bits (Rust/crypto expertise)

---

9. Post-Testing Actions

Immediate (within 1 week):

1. Remediate all critical vulnerabilities
2. Implement temporary mitigations for high-severity issues
3. Update security documentation

Short-term (within 1 month):

1. Complete all high-severity remediations
2. Re-test fixed vulnerabilities
3. Update security policies

Long-term (within 3 months):

1. Address all medium/low findings
2. Implement security enhancements
3. Schedule next penetration test (annual)

---

10. Conclusion

This penetration testing plan provides a comprehensive framework for validating the security of the Foxhunt HFT trading system. Successful completion of this testing will:

1. Validate Security Controls: Confirm TLS/mTLS, input validation, and authentication effectiveness
2. Identify Gaps: Discover and remediate vulnerabilities before production
3. Ensure Compliance: Validate SOX/MiFID II requirements
4. Build Confidence: Provide assurance to stakeholders and regulators

Estimated Budget: $50,000-$75,000
Timeline: 7 weeks (November-December 2025)
Next Steps: Approve plan, select vendor, schedule testing

---

Prepared by: Agent 115 (Security Audit)
Approved by: [Pending - CISO approval]
Date: 2025-10-08