Til:

Kiberxavfsizlik: API Xavfsizligi va Rate Limiting

Amaliy Laboratoriya Varaqasi · 10–11-sinf · 5-hafta · 23-dars
Talaba: Sinf:  |  Sana: Baho:      / 10

Laboratoriya Vazifasi: API Defender Studio Kvestlari

Interaktiv API Defender Studio (studio/index.html) muhitida Token Bucket chelagi bilan DDoS hujumlarini qaytarish, WebCrypto API orqali HMAC-SHA256 so'rov imzolash, Tamper (soxtalashtirish) va Replay Attack hujumlarini fosh qilish.

Amaliy Kvest (Studio)Harakat / Hujum TuriKutilgan Natija (Status)Ball va Holat
1. Tokenlarni Bo'shatish`1x So'rov` tugmasini ketma-ket 10 marta bosingTokenlar 0 ga tushadi, HTTP 429 Too Many Requests olinadi2 ball / [ ]
2. 50 RPS DDoS Hujumi`50 RPS Portlash (DDoS)` oqimini yoqishChelak toshadi: 20+ ta ortiqcha so'rov 429 bilan to'xtatiladi3 ball / [ ]
3. Soxtalashtirish (Tamper)`Soxtalashtirish` tugmasi ($100 -> $999,999)HMAC imzosi buziladi: HTTP 403 / 401 Signature Mismatch!3 ball / [ ]
4. Replay Attack SinoviEski so'rovni bir xil Nonce bilan qayta yuborishServer Nonce keshini ko'rib, HTTP 401 Replay Detected beradi2 ball / [ ]

Xavfsizlik Tahlili va Nazariy Savollar

1. Nega taqsimlangan mikroservislarda (Kubernetes klasterida) rate limiting lokal xotirada (RAM) emas, Redis orqali yuritilishi shart?


2. API so'rovlarida HMAC-SHA256 imzosi, X-Timestamp va X-Nonce birgalikda qanday qilib Replay Attack va Tampering hujumlarini to'xtatadi?

Baholash Mezoni (10 Ball)

  • Token Bucket algoritmi va Redis taqsimlangan arxitekturasi to'g'ri tushuntirilgan 3 ball
  • HMAC-SHA256 imzosi, X-Nonce va Replay Attack himoyasi to'liq asoslangan 3 ball
  • OWASP API Top 10 (BOLA, DDoS, Mass Assignment) va T-Mobile keysi tahlil qilingan 2 ball
  • Laboratoriya bosqichlari to'liq bajarilgan va yozma savollarga asosli javob berilgan 2 ball
  • JAMI 10 ball
O'qituvchi: Musulmonov Mamarajab O'qituvchi imzosi: _______________ Target International School