Papkani majmuaviy izlash

Yashirin fayl va papkalar

Dars 33 O'rta o'z saytingizda

Maqsad

yashirin fayl va papkalarni topish

Ommaviy fayl ro'yxati orqali serverdagi yashirin resurslarni topish: boshqaruv paneli, backup fayllar, sozlamalar, tizim ma'lumotlari.

Tushuntirish

Nima qidiriladi

Guruh	Misol	Nima uchun
Sezsirli fayllar	`.env`, `.git`, `.htaccess`	Kalitlar, kod tarixi
Backup	`backup.sql`, `site.zip`, `db.php.bak`	Baza va kod
Konfiguratsiya	`config.php`, `web.config`	DB paroli
Papani izlash	`/admin`, `/panel`, `/cpanel`	Boshqaruv
Dev qoldiqlari	`package.json`, `.gitignore`	Texnologiya, yo'llar
Maxfiy	`/debug`, `/phpinfo.php`	Server ma'lumoti

Qanday aniqlanadi

# 1) texnologiya (qanday ro'yxat ishlatish)
curl -s -I https://site.uz/ | grep -iE "server|x-powered-by|set-cookie"
grep -oE "wp-content|/_next/|/static/|Laravel|Prestashop|OpenCart" /tmp/index.html 2>/dev/null

# 2) robots.txt va sitemap
curl -s https://site.uz/robots.txt
curl -s https://site.uz/sitemap.xml | head -20

# 3) 404 boshqaruvi
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz/yoq-bunday-fayl-12345
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz/ADMIN
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz/admin
# 200 → mavjud; 403 → mavjud, lekin yopiq (ma'lumot!); 404 → yo'q

Buyruqlar

asboblar

# 1) gobuster (eng oddiy)
gobuster dir -u https://site.uz -w /usr/share/wordlists/dirb/common.txt -x php,txt,bak,old,zip,sql -t 30 --no-error
# -x = kengaytmalar (fayl izlash)

# 2) feroxbuster — recursive + fayl
feroxbuster -u https://site.uz -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,json,log,bak,old,zip,sql,env -d 3

# 3) ffuf — eng moslashuvchan
ffuf -u https://site.uz/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,204,301,302,307,401,403 -fc 404 -t 40 -rate 100

# 4) maxfiy fayllar (qisqa ro'yxat)
for F in .env .git/config .git/HEAD .htaccess .gitignore .DS_Store web.config config.php.bak backup.sql db.sql dump.sql phpinfo.php info.php test.php .aws/credentials id_rsa .bash_history Dockerfile docker-compose.yml; do
  C=$(curl -s -o /dev/null -w "%{http_code}" "https://site.uz/$F")
  [ "$C" != "404" ] && echo "  /$F → HTTP $C"
done

# 5) content-length farqini aniqlash (yaxshiroq 404 usuli)
for P in admin panel wp-admin administrator dashboard; do
  echo "  /$P → $(curl -s -o /dev/null -w '%{http_code} %{size_download}' https://site.uz/$P)"
done

# 6) recursive (papkaning ichi)
gobuster dir -u https://site.uz/api -w common.txt -x json,js -q
ffuf -u https://site.uz/uploads/FUZZ -w common.txt -mc 200 -fc 404

REM gobuster / feroxbuster — Windows da ham ishlaydi
gobuster.exe dir -u https://site.uz -w common.txt -x php,txt,bak -t 30

REM ffuf (Windows binary)
ffuf.exe -u https://site.uz/FUZZ -w common.txt -mc 200,403 -fc 404 -t 40

REM PowerShell — qo'lda (maxfiy fayllar)
$files = @(".env",".git/config",".git/HEAD",".htaccess","web.config","config.php.bak","backup.sql","phpinfo.php","id_rsa")
foreach ($f in $files) {{
  $c = (Invoke-WebRequest "https://site.uz/$f" -UseBasicParsing -ErrorAction SilentlyContinue)
  if ($c -and $c.StatusCode -ne 404) {{ "  /$f -> HTTP $($c.StatusCode)" }}
}}

REM PowerShell — content-length usuli
foreach ($p in @("admin","panel","wp-admin","dashboard")) {{
  try {{
    $r = Invoke-WebRequest "https://site.uz/$p" -UseBasicParsing -ErrorAction Stop
    "  /$p -> $($r.StatusCode) $($r.RawContentLength) bayt"
  }} catch {{ "  /$p -> $($_.Exception.Response.StatusCode.value__)" }}
}}

REM CMD — quick check
for %F in (.env .git\HEAD .htaccess web.config backup.sql) do @curl -s -o NUL -w "%{http_code} /%F
" https://site.uz/%F

# brauzer konsolida — server-side discovery
for (const p of ['.env','.git/HEAD','.htaccess','web.config','config.php.bak',
                 'backup.sql','phpinfo.php','admin','panel','wp-admin']) {{
  const r = await fetch('/' + p, {{ method:'HEAD' }});
  if (r.status !== 404) console.log(p, '->', r.status, r.headers.get('content-length'));
}}

# Fetch API bilan bir nechta yo'lni parallel tekshirish
const paths = ['/api','/api/v1','/api/v2','/api/config','/api/debug','/internal'];
const res = await Promise.all(paths.map(p => fetch(p).then(r => [p, r.status])));
console.log(res.filter(([,s]) => s < 400));

Natija

✓ MUvaffaqiyat — hujum ISHLADI

Server javobi	Nima degani
`200` — fayl/papka mavjud	Topildi
`403` — mavjud, lekin taqiqlangan	Mavjudligi tasdiqlandi
`.env` → 200/403	Kalitlar ochiq — kritik
`.git/HEAD` → 200	Butun kod tarixi ochiq
`200` + `Size 12KB` — real fayl	Ishga tushirish uchun

✗ Rad etish — hujum ISHLAMADI

Server javobi	Nima degani
`Barchasi 404`	Yaxshi
`200` lekin bo'sh (0 bayt)	Eski tipdagi 200 — tekshirish kerak
`403 va 404 birlashtirilgan`	Yaxshi (2000+ faylni yashiradi)

Zararni yopish

1. Options -Indexes (papkalar ro'yxatini o'chirish)

# .htaccess / nginx
Options -Indexes
autoindex off;
index.php index.html

2. Maxfiy fayllarni bloklash

# nginx
location ~ /\. {{ return 404; }}                       # .env .git .htaccess
location ~* \.(bak|old|sql|log|ini|conf|swp|zip|tar\.gz)$ {{ return 404; }}
location ~* ^/(config|configuration|wp-config)\.php {{ return 404; }}

# Apache
<FilesMatch "^\.(env|git|htaccess)">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git

3. To'liq kod ko'rinmasin

# veb ildirishda .git va node_modules ni chiqarish
rsync -a --exclude='.git' --exclude='node_modules' ./ dist/

# lekin .bak, .old, .swp — har doim chiqib qoladi

4. Bir xil 404 (zararli emas, lekin yaxshi)

ErrorDocument 403 /index.php

5. Monitoring

Brute force skanerlashni bloklash (405/429 javob)
G'ayratli 403 larni qayd etish va takrorlash
Eng muhimi: topilgan fayllarni darhol yopish

Tekshirish ro'yxati

`.env`, `.git`, `.bak` — 403/404
`Options -Indexes` yoqilgan
Backup fayllar web ildirishdan chiqarilgan
Web-root da `.env` yo'q (yuqorida)
404 sahifasi har qanday yo'lda bir xil
G'ayratli 403 larni monitoring qilinadi
`gobuster` bilan tekshirildi