Port skanlash (nmap)

≡ Barcha darslar
Tezkor 🔎 Indeks
🔌

Port skanlash (nmap)

Ochiq portlarni aniqlash
Dars 35 O'rta o'z saytingizda
1

Maqsad

ochiq portlarni aniqlash

Serverda qaysi xizmatlar ochiqligini bilmasak — zaiflikni topolmaymiz. Port skanlash — birinchi qadam.

2

Tushuntirish

portlarning ma'nosi
PortXizmatNima tekshiriladi
21, 22, 23FTP, SSH, TelnetKuchsiz parol, eski versiya
25, 587SMTPOpen relay, spamma uchun
80, 443HTTP(S)Sayt, header, zaif versiya
3306, 5432MySQL, PostgreSQLInternetda ochiq bo'lsa — xato
6379RedisParolsiz = to'liq nazorat
27017MongoDBAutentifikatsiya bormi
9200ElasticsearchOchiq klaster
8080, 8000, 5000Dev serverlarMaxfiy xizmatlar
3

Qanday aniqlanadi

boshqaruv portlari
# 1) o'z serveringizda ochiq portlar (info)
ss -tulpn | head -20
netstat -tulpn 2>/dev/null | head -20

# 2) skanerlashni boshlash
nmap -sT -p- --min-rate 5000 site.uz     # barcha portlar (TCP)
nmap -sV -sC -p 80,443,22 site.uz        # mashhur portlar + skriptlar
4

Buyruqlar

nmap
# 1) ENG KO'P ISHLATILADIGAN — boshlang'ich skan
nmap -sV -sC -O --top-ports 1000 site.uz

# 2) barcha portlar (to'liq, biroz sekin)
nmap -sV -p- --min-rate 10000 site.uz
# --min-rate = qanchalik tez (serverni bosmay qo'yish uchun past)

# 3) 3 ta qulay skan
nmap -sn 10.0.0.0/24                    # ping sweep (kim bor)
nmap -sS -T4 -p- site.uz                # to'liq SYN (root kerak)
nmap -sV -Pn -p 1-10000 site.uz          # past portlar

# 4) UDP (sekin, lekin ba'zi xizmatlar faqat UDP)
nmap -sU --top-ports 50 --min-rate 500 site.uz

# 5) aniq xizmatlar
nmap -sV -p 22,80,443,3306,5432,6379,27017,9200 site.uz

# 6) skriptlar bilan (avtomatik zaiflik tekshiruvi)
nmap -sV --script=http-title,http-headers site.uz
nmap -sV --script=vulners,vuln site.uz        # CVE qidirish
nmap -p 6379 --script redis-info site.uz
nmap -p 3306 --script mysql-info site.uz
nmap -p 27017 --script mongodb-info site.uz

# 7) chegara (firewall) aniqlash
nmap -sS -p 1-1000 --traceroute site.uz
nmap -sA site.uz     # ACK — filtrlash aniqlanadi

# 8) tarmoq (barcha IP lar)
nmap -sn 10.0.0.0/24 | grep -oE "10\.0\.0\.[0-9]+" | while read IP; do
  nmap -sV -p- $IP
done

# 9) masspeed (kurumsal daraja)
masscan -p1-65535 --open site.uz        # juda tez, keyin nmap bilan tasdiqlang
5

Natija

✓ MUvaffaqiyat — hujum ISHLADI
Server javobiNima degani
`3306/tcp open mysql` — IP da**DB ochiq — jiddiy**
`6379/tcp open redis` (auth yo'q)**Redis ochiq = to'liq nazorat**
`8080/tcp open http-proxy`**Maxfiy dev server**
`22/tcp open ssh OpenSSH_7.4`**Eski versiya — yangilang**
`23/tcp open telnet`**Ochiq login — darhol yoping**
✗ Rad etish — hujum ISHLAMADI
Server javobiNima degani
Faqat 80, 443, 22 ochiq**Normal holat**
`filtered` — firewall bor**Yaxshi**
DB portlari `closed`**To'g'ri** — ichkarida
6

Zararni yopish

1. Keraksiz portlarni yopish

# qaysi xizmatlar kerak?
sudo ss -tulpn              # faqat kerakli bo'lsin
sudo systemctl stop telnet

# DB faqat lokal (127.0.0.1) bilan
bind-address = 127.0.0.1     # MySQL
redis-server --bind 127.0.0.1 requirepass YANGIZ_PAROL

# firewall (faqat kerakli portlar)
sudo ufw default deny incoming
sudo ufw allow 22/tcp 80/tcp 443/tcp
sudo ufw enable

2. Autentifikatsiya

// Redis
requirepass uzun-tasodifiy-parol

// MongoDB
security.authorization: enabled

// SSH
PasswordAuthentication yes
PermitRootLogin no        # ← MUHIM

3. Versiya yashirish

// banner o'zgartirish — nmapni biroz chalg'itadi
TCPBanner / ServiceInfo uzun-nomi   # /etc/banner
// lekin bu ASOSIY himoya emas — yangilash asosiy

4. Monitoring

sudo ufw status verbose
nmap -sV -p- site.uz | diff old.txt new.txt   # oylik
7

Tekshirish ro'yxati

  • DB (3306, 5432, 27017) faqat lokal
  • Redis/Mongo autentifikatsiya bilan
  • Telnet o'chirilgan, SSH root'ga o'chiq
  • Firewall faqat 22/80/443 ochiq
  • Kerakli portlar ko'rib chiqilgan (ro'yxat bilan)
  • Oylik port skan farqi kuzatiladi
  • `nmap -p-` bilan tekshirildi
← Oldingi
🌐 Subdomain izlash
Keyingi →
🔗 OAuth / OIDC zaifliklari