VEB-ILOVALARDA HTTP SO‘ROVLARNI YASHIRISH (REQUEST SMUGGLING) ZAIFLIGINI AMALIY ANIQLASH VA MODELLASHTIRISH METODOLOGIYASI
Abstract
Annotatsiya: Zamonaviy ko‘p qatlamli veb-arxitekturalarda HTTP so‘rovlarini qayta ishlashdagi nomuvofiqliklar murakkab xavfsizlik zaifliklarini yuzaga keltiradi. Mazkur maqola HTTP Request Smuggling zaifligini amaliy jihatdan aniqlash, serverlar o‘rtasidagi “HTTP parsing” jarayonidagi desinxronizatsiyani modellashtirish va ushbu jarayonda qo‘llaniladigan amaliy vositalarga (Burp Suite, Turbo Intruder) bag‘ishlanadi. Tadqiqot davomida “socket poisoning” (ulanishda so‘rov qismining osilib qolishi) holatlarini aniqlash bo‘yicha ikki bosqichli amaliy test metodologiyasi hamda uning natijalari batafsil tahlil qilingan.
References
1. PortSwigger Ltd. Burp Suite Documentation.
URL: https://portswigger.net/burp/documentation.
2. PortSwigger Ltd. HTTP Request Smuggling. URL: https://portswigger.net/web-security/request-smuggling.
3. Docker Inc. Docker Documentation (Laboratoriya muhitini yaratish va modellashtirish uchun). URL: https://docs.docker.com.
4. Stuttard D., Pinto M. The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws. Wiley Publishing, 2011.
5. Klein A. Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics.
