OWASP TOP 10 ASOSIDA WEB ILOVALARNI PENETRATSION TESTLASH: KOMPLEKS TAHLIL
Abstract
Maqolada web ilovalar xavfsizligini baholashda penetratsion
testlash jarayonini OWASP Top 10 freymvorki asosida tizimlashtirish masalasi
tadqiq etilgan. Tadqiqotning maqsadi OWASP Top 10 kategoriyalari, nazorat
qilinadigan amaliy test va CVSS baholashini yagona metodologik ketma-ketlikka
birlashtirish hamda ushbu yondashuvning web ilovalardagi muhim zaifliklarni
aniqlashdagi amaliy imkoniyatlarini baholashdan iborat. Tadqiqot izolyatsiya
qilingan virtual laboratoriyada, qasddan zaiflashtirilgan web ilova muhitida kulrang
quti yondashuvi asosida o'tkazildi. Burp Suite, OWASP ZAP, sqlmap, Nmap va
Nikto vositalaridan foydalanilib, aniqlangan holatlar CVSS v3.1 mezonlari bo'yicha
baholandi. Natijada olti turdagi zaiflik aniqlandi: ularning uchtasi yuqori, uchtasi
o'rta xavf darajasiga mansub bo'ldi. Eng yuqori CVSS ko'rsatkichi SQL in'eksiyasida
(8.6), undan keyin IDOR ko'rinishidagi buzilgan kirish nazoratida (8.1) va
autentifikatsiya kamchiligida (7.5) qayd etildi. Natijalar avtomatlashtirilgan
skanerlashni qo'lda tahlil bilan birlashtirish, xavfsizlik talablarini SDLCning
dastlabki bosqichlariga kiritish va penetratsion testlarni muntazam o'tkazish
zarurligini ko'rsatadi.
Maqolani onlayn o'qish
References
- [1] OWASP Foundation. OWASP Top 10:2021 — The Ten Most Critical Web
- Application Security Risks. OWASP, 2021.
- [2] OWASP Foundation. OWASP Web Security Testing Guide (WSTG) v4.2.
- OWASP, 2020.
- [3] OWASP Foundation. OWASP Application Security Verification Standard
- (ASVS) v4.0.3. OWASP, 2021.
- [4] OWASP Foundation. OWASP API Security Top 10:2023. OWASP, 2023.
- [5] Stuttard, D., Pinto, M. The Web Application Hacker's Handbook: Finding and
- Exploiting Security Flaws. 2nd ed. Wiley, 2011.
- [6] Weidman, G. Penetration Testing: A Hands-On Introduction to Hacking. No
- Starch Press, 2014.
- [7] National Institute of Standards and Technology. NIST SP 800-115: Technical
- Guide to Information Security Testing and Assessment. 2008.
- 63 ISSN: 3093-9305
- VOLUME - 2
- [8] Engebretson, P. The Basics of Hacking and Penetration Testing. 2nd ed.
- Syngress, 2013.
- [9] FIRST. Common Vulnerability Scoring System v3.1: Specification Document.
- Forum of Incident Response and Security Teams, 2019.
- [10] PortSwigger. Web Security Academy — Learning Materials on Web
- Vulnerabilities. 2023.
- [11] O'zbekiston Respublikasining 2022-yil 15-apreldagi O'RQ-764-son
- 'Kiberxavfsizlik to'g'risida'gi Qonuni.
- [12] Kim, P. The Hacker Playbook 3: Practical Guide to Penetration Testing. 2018.