Kiberxavfsizlik asoslari va
Web Pentest uchun Yo’l xaritasi
Kiberxavsizlikka Kirish
• Offensive Security Intro
• Defensive Security Intro
• Careers in Cyber
• Cybersecurity Concepts Overview
Linux Asoslari
• https://academy.hackthebox.com/module/details/18
• https://tryhackme.com/room/linuxmodules
• https://tryhackme.com/room/ninjaskills
• https://overthewire.org/wargames/bandit/
Windows Asoslari
• https://academy.hackthebox.com/module/details/49
• https://tryhackme.com/room/windowscommandline
• https://tryhackme.com/room/windowsfundamentals1xbx
• https://tryhackme.com/room/windowsfundamentals2x0x
• https://tryhackme.com/room/windowsfundamentals3xzx
Tarmoq Asoslari
• https://academy.hackthebox.com/module/details/34
• https://academy.hackthebox.com/module/details/289
• https://tryhackme.com/room/whatisnetworking
• https://tryhackme.com/room/introtonetworking
• https://tryhackme.com/room/networkingconcepts
Web Sayt/Applicationlar qanday ishlaydi?
• https://tryhackme.com/room/webapplicationbasics
• https://tryhackme.com/room/howwebsiteswork
• https://tryhackme.com/room/httpindetail
• https://tryhackme.com/room/introwebapplicationsecurity
• https://academy.hackthebox.com/module/details/35
• https://academy.hackthebox.com/module/details/75
2
Burp Suite va Proxy Tools
• https://academy.hackthebox.com/module/details/110
• https://tryhackme.com/room/learnowaspzap
Web Hacking Fundamentals
Recon/Enumeration
• https://academy.hackthebox.com/module/details/144
Information Disclosure
• https://portswigger.net/web-security/information-disclosure
SQL Injection and NoSQL Injection
• https://tryhackme.com/room/sqlilab
• https://tryhackme.com/room/sqlinjectionlm
• https://academy.hackthebox.com/module/details/33
• https://portswigger.net/web-security/learning-paths/sql-injection
• https://tryhackme.com/room/advancedsqlinjection
• https://academy.hackthebox.com/module/details/58
• https://tryhackme.com/room/nosqlinjectiontutorial
• https://portswigger.net/web-security/learning-paths/nosql-injection
XSS and DOM-Based Vulnerabilities
• https://tryhackme.com/room/axss
• https://portswigger.net/web-security/cross-site-scripting
• https://academy.hackthebox.com/module/details/103
Authentication Flaws
• https://portswigger.net/web-security/authentication
• https://tryhackme.com/room/enumerationbruteforce
• https://tryhackme.com/room/bypassreallysimplesecurity
• https://tryhackme.com/room/nextjscve202529927
• https://academy.hackthebox.com/module/details/80
• https://academy.hackthebox.com/module/details/134
Path Traversal va Local/Remote File Inclusion
• https://portswigger.net/web-security/file-path-traversal
• https://academy.hackthebox.com/module/details/23
3
Command Injection
• https://portswigger.net/web-security/os-command-injection
• https://academy.hackthebox.com/module/details/109
Business Logic Vulnerabilities and Rate Limiting
• https://portswigger.net/web-security/logic-flaws
• https://portswigger.net/web-security/race-conditions
• https://tryhackme.com/room/raceconditions
Access Control Issues
• https://portswigger.net/web-security/access-control
File Upload and XXE Injection
• https://academy.hackthebox.com/module/details/136
• https://portswigger.net/web-security/file-upload
• https://portswigger.net/web-security/xxe
Server-Side Request Forgery (SSRF)
• https://tryhackme.com/room/ssrfhr
• https://academy.hackthebox.com/module/details/145 (SSRF section is recommended)
• https://portswigger.net/web-security/ssrf
Cross-Site Request Forgery (CSRF)
• https://tryhackme.com/room/csrfV2
• https://portswigger.net/web-security/csrf
CORS Misconfigurations
• https://portswigger.net/web-security/cors
Clickjacking
• https://portswigger.net/web-security/clickjacking
4
JWT and OAuth Security
• https://portswigger.net/web-security/jwt
• https://portswigger.net/web-security/oauth
API Testing, WebSocket, and GraphQL Security
• https://portswigger.net/web-security/api-testing
• https://portswigger.net/web-security/websockets
• https://portswigger.net/web-security/graphql
Insecure Deserialization
• https://tryhackme.com/room/insecuredeserialisation
• https://portswigger.net/web-security/deserialization
Server-Side Template Injection (SSTI)
• https://tryhackme.com/room/learnssti
• https://academy.hackthebox.com/module/details/145 (SSTI qismi tavsiya qilinadi)
• https://portswigger.net/web-security/server-side-template-injection
LLM Hacking
• https://portswigger.net/web-security/llm-attacks
• https://academy.hackthebox.com/module/details/297
Web Cache Poisoning/Deception
• https://portswigger.net/web-security/web-cache-poisoning
• https://portswigger.net/web-security/web-cache-deception
HTTP Request Smuggling
• https://tryhackme.com/room/httprequestsmuggling
• https://tryhackme.com/room/http2requestsmuggling
• https://portswigger.net/web-security/request-smuggling
Prototype Pollution
• https://portswigger.net/web-security/prototype-pollution
5
Host Header Injection
• https://portswigger.net/web-security/host-header
Tavsiya qilinadigan youtube kanallar va videolar
Rana Khalil - Ko’pgina mavzular tushintirib berilgan
Z3nsh3ll - Asosan XSS va DOM XSS zaifliklari yaxshi tushintirilgan
Integriti - Bir qancha labatoriyalarni ishlashni yaxshi tushintirilgan
Jarno Timmermans - HTTP smuggling, Web Cache poisioning va CSRF zaifliklari yaxshi tushintirilgan
Porswigger Research Team - Portswigger jamoasi zaifliklarni qanday qilib aniqlashgani haqida
qiziqarli chiqishlar
Nahamsec - Umumiy pentest va bug hunting jarayoni haqida yaxshigina ma’lumotlar olish mumkin
Darknet Diaries - Interdagi qiziqarli voqealar haqida Gurung
Critical Thinking – Top Bug Bountychilar bilan suhbatlar va zaifliklar tahlili
Bug Bounty Report Explained – Bug Bountydagi Zaifliklar tahlili
