Parol to'g'ri kelganda 2FA ishga tushadi. Endi kodning o'zi zaifligini ko'rib chiqamiz — bunda hujum parolsiz ishlaydi.

# 1) 2FA yo'lari
grep -rniE "totp|2fa|twofa|mfa|backup.?code|recovery" src/ | head

# 2) vaqt oynasi
grep -rnE "window|drift|step|authenticator" src/services/ | head

# 3) backup kodlar saqlanadimi
grep -rniE "backupCode|recoveryCode|backup_code" src/ | head

# 1) TOTP kodlarni hisoblash (joriy va qo'shni step)
python3 - <<'PYEOF'
import hmac, hashlib, struct, time, base64
S = 'JBSWY3DPEHPK3PXP'   # o'z testingizni ishlating
def totp(s, step=30, off=0):
    k = base64.b32decode(s.upper() + '=' * ((8 - len(s) % 8) % 8))
    c = struct.pack('>Q', int(time.time() // step) + off)
    h = hmac.new(k, c, hashlib.sha1).digest()
    o = h[19] & 15
    return str((struct.unpack('>I', h[o:o+4])[0] & 0x7fffffff) % 10**6).zfill(6)
for off in (-2, -1, 0, 1, 2):
    print(f"  step{off:+d}: {totp(S, 30, off)}")
PYEOF

# 2) ±step larni sinab ko'rish (o'z 2FA nizomiz)
T=$(curl -s -X POST https://site.uz/api/auth/admin-panel-login \
  -H "Content-Type: application/json" -d '{"email":"...","password":"..."}' | jq -r .token)
for OFF in -2 -1 0 1 2; do
  C=$(python3 -c "import hmac,hashlib,struct,time,base64
S='JBSWY3DPEHPK3PXP'
k=base64.b32decode(S+'='*((8-len(S)%8)%8))
c=struct.pack('>Q', int(time.time()//30) + $OFF)
h=hmac.new(k,c,hashlib.sha1).digest(); o=h[19]&15
print(str((struct.unpack('>I',h[o:o+4])[0]&0x7fffffff)%10**6).zfill(6))")
  R=$(curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Authorization: Bearer $T" \
      -H "Content-Type: application/json" -d "{\"code\":\"$C\"}" | jq -r .success)
  echo "  offset $OFF → code $C → success=$R"
done

# 3) REPLAY — bir kodni ikki marta
C=$(python3 -c "...")   # joriy kod
curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Authorization: Bearer $T" \
  -H "Content-Type: application/json" -d "{\"code\":\"$C\"}" | jq -c .
sleep 35
curl -s -X POST https://site.uz/api/auth/verify-tfa -H "Authorization: Bearer $T" \
  -H "Content-Type: application/json" -d "{\"code\":\"$C\"}" | jq -c .
# ikkalasi ham true → replay

# 4) backup kodlar
curl -s -X POST https://site.uz/api/auth/2fa/verify-backup \
  -H "Authorization: Bearer $T" -H "Content-Type: application/json" \
  -d '{"code":"12345678"}' | jq -c .
# o'sha kodni qayta ishlatish:
curl -s -X POST https://site.uz/api/auth/2fa/verify-backup \
  -H "Authorization: Bearer $T" -H "Content-Type: application/json" \
  -d '{"code":"12345678"}' | jq -c .

# 5) TELEGRAM orqali 2FA (kod sizga keladi = o'g'rinadi)
curl -s -X POST https://site.uz/api/auth/telegram/send-code -d '{"phone":"+998901234567"}' | jq -c .
# Telegram bot orqali kodni o'g'rish mumkin → SMS/TOTP afzal

# 6) kirish vaqtini o'lchash (mashin va inson farqi)
for I in 1 2 3; do
  T2=$(curl -s -X POST https://site.uz/api/auth/admin-panel-login \
       -H "Content-Type: application/json" -d '{"email":"...","password":"..."}' | jq -r .token)
  time curl -s -o /dev/null -X POST https://site.uz/api/auth/verify-tfa \
    -H "Authorization: Bearer $T2" -H "Content-Type: application/json" -d '{"code":"000000"}'
done

1. Vaqt oynasini qisqartirish

const step = Math.floor(Date.now() / 1000 / 30);
if (step !== storedStep) return fail();        // faqat joriy
// yoki ±1 (server va telefon sekin bo'lishi mumkin)

2. Replay himoyasi

const used = await redis.get(`tfa:${userId}:${code}`);
if (used) return fail('bu kod ishlatilgan');
await redis.set(`tfa:${userId}:${code}`, 1, 'EX', 30);
// yoki: user.lastStep ni saqlab, undan kichik bo'lsa rad etish

3. Backup kodlar

// 10 ta kod, bcrypt bilan saqlanadi
codes.forEach(c => bcrypt.hashSync(c, 10))    // baza: bcrypt hash
// ishlatilgani belgilanadi va O'CHIRILADI
db.backupCodes.splice(db.backupCodes.indexOf(hash), 1);
// foydalanuvchiga faqat BIR marta ko'rsatadi

4. Rate limit — qat'iy

if (attempts >= 5) { blockFor(userId, 15 * 60); notify(user); }
// IP bilan birga: 10 urish / 15 daqiqa
notify(user.email, `2FA urishlari: ${attempts}`);   // xabar berish

5. Usul tanlash

Telegram orqali 2FA — bu tasdiqlash emas, chunki Telegram akkaunti alohida zaiflik. Maqsadli auditoriya uchun TOTP yoki FIDO2 kaliti.

• Faqat joriy TOTP step qabul qilinadi
• Ishlatilgan kod 30 sek qaytarilmaydi
• Backup kodlar bcrypt bilan, bir marta ishlatiladi
• 5 xato → blok + xabarnoma
• Telegram/Email orqali 2FA ishlatilmadi
• Parolni o'zgartirish 2FA'ni qayta so'raydi
• 2FA'ni o'chirish parol bilan tasdiqlanadi