# TCP Handshake Tushunchasi ## Bu darsda nima qilamiz? TCP — Internetning asosi, va pentester uchun eng muhim protokol. Bu darsda TCP ning ishlash mexanizmini, three-way handshake jarayonini, va Go'da TCP bilan qanday ishlashni ko'ramiz. Port tekshirish, banner grabbing, va SYN flood hujumi haqida ham gapiramiz — bularning hammasi keyingi darslardagi skanerlar va proksilarning poydevori. ## TCP nima va nima uchun muhim? **TCP (Transmission Control Protocol)** — ishonchli, ulanishga asoslangan transport protokoli. "Ishonchli" degani: yuborilgan har bir byte yetib boradi, yo'qolsa qayta yuboriladi, tartib buzilmaydi. Bu kafolat TCP ni HTTP, SSH, FTP kabi xizmatlar uchun ideal qiladi — har bir bit muhim bo'lganda TCP ishlatiladi. Pentest qilayotganda TCP ni bilish shart, chunki: - **Port skanerlash** — TCP SYN/ACK javobiga qarab port ochiq yoki yopiqligini bilamiz - **Banner grabbing** (xizmat identifikatsiyasi) — ochiq portga ulanib, qaysi dastur ishlayotganini ko'ramiz - **Firewall bypass** — handshake ni manipulyatsiya qilib himoyadan o'tamiz - **Reconnaissance** — tarmoq topologiyasini tushunish uchun asosiy vosita TCP ni UDP bilan qiyoslaylik: | | TCP | UDP | |---|---|---| | Ulanish | Talab qilinadi | Yo'q | | Ishonchlilik | Kafolatlangan | Best-effort | | Tartib | Saqlaydi | Saqlaydi | | Tezlik | Sekinroq | Tezroq | | Misol | SSH, HTTP, FTP | DNS, video streaming | UDP ni ham bilish kerak, lekin bu modul TCP ustiga qurilgan — port skanerlash, banner grabbing, proksi — barchasi TCP ustida ishlaydi. ## Three-Way Handshake TCP ulanish o'rnatish uchun **uch bosqichli qo'l berib olish** kerak. Tasavvur qiling: ikki kishi telefon orqali gaplashmoqchi. 1. **SYN** — "Eshityapsanmi?" (Client serverga ulanish so'raydi) 2. **SYN-ACK** — "Eshityapman, sen eshityapsanmi?" (Server ham tayyor ekanini bildiradi) 3. **ACK** — "Ha, eshityapman!" (Client tasdiqlaydi, ulanish o'rnatildi) Bu o'xshatish juda muhim: ikkala tomon ham gapirishga tayyor ekanligini tasdiqlashi kerak, shuning uchun aynan uch bosqich. ```mermaid sequenceDiagram participant C as Client participant S as Server Note over C,S: Ulanish yo'q — CLOSED holat C->>S: SYN (seq=100) Note over C: SYN_SENT Note over S: SYN_RECEIVED S->>C: SYN-ACK (seq=300, ack=101) C->>S: ACK (seq=101, ack=301) Note over C,S: ESTABLISHED — ma'lumot almashish boshlanadi C->>S: Data (HTTP GET, SSH, va h.k.) S->>C: Data (HTTP 200 OK, va h.k.) ``` Nima uchun aynan uch bosqich? Ikki bosqich yetmaydi, chunki har ikki tomon ham **o'z sequence number** ini e'lon qilib, tasdiqlashini olishi kerak. Client SYN yuboradi (o'z SEQ ni aytadi), Server SYN-ACK qaytaradi (Server SEQ ni aytadi va Client SEQ ni tasdiqlaydi), Client ACK yuboradi (Server SEQ ni tasdiqlaydi). Agar ikki bosqich bo'lsa, Server o'z SEQ ni Client tasdiqlashini ko'rmaydi — to'liq sinxronizatsiya yo'q. **Sequence number** tasodifiy boshlanadi — agar har doim 0 dan boshlansa, tajovuzkor keyingi raqamni bashorat qilib, soxta paket yuborishi mumkin (**TCP Sequence Prediction** hujumi). Zamonaviy OS lar kriptografik usulda tasodifiy SEQ ishlatadi. ## TCP flaglari TCP headerida 6 ta flag bor, ularning har biri ulanish holatini boshqaradi. Bu flaglarni bilmasdan port skanerlash mexanizmini tushunib bo'lmaydi — chunki skanerlar aynan shu flaglarni tahlil qiladi. ```go // Flag qiymatlari (bitmask) — Go kodida const ( FIN = 1 << 0 // 0x01 — Ulanishni yopish SYN = 1 << 1 // 0x02 — Ulanishni boshlash RST = 1 << 2 // 0x04 — Ulanishni zudlik bilan uzish PSH = 1 << 3 // 0x08 — Ma'lumotni darhol application'ga yuborish ACK = 1 << 4 // 0x10 — Oldingi paketni tasdiqlash URG = 1 << 5 // 0x20 — Shoshilinch ma'lumot (kam ishlatiladi) ) ``` Bu konstantalarni real kodda ishlatmaysiz (Go'ning `net` paketi bularni yashiradi), lekin network monitoring va raw socket dasturlashda kerak bo'ladi. Pentest uchun eng muhimlari: - **SYN** — port ochiq yoki yo'qligini tekshirish uchun (SYN scan asosi) - **RST** — server port yopiq bo'lsa shu flag bilan javob beradi; tajovuzkor ham sessiyani buzish uchun ishlatadi - **FIN** — ulanishni to'g'ri yopish; stealth skanerlashda ham ishlatiladi - **ACK** — deyarli har bir paketda bor; firewall bypass texnikalarida muhim Har bir flag kombinatsiyasi ma'lum holat anglatadi: - `SYN=1, ACK=0` — birinchi qo'ng'iroq (handshake bosqich 1) - `SYN=1, ACK=1` — javob (handshake bosqich 2) - `SYN=0, ACK=1` — tasdiq (handshake bosqich 3 va barcha data paketlar) - `RST=1` — darhol uzish (port yopiq yoki xato) - `FIN=1, ACK=1` — muloqatni to'g'ri yakunlash ## Go'da TCP ulanish Go'da TCP bilan ishlash juda sodda — `net` paketi hamma narsani qoplaydi. Uch qator kod bilan to'liq three-way handshake amalga oshiriladi. ### Port tekshirish Birinchi amaliy misol: berilgan host va portga ulanishga urinib ko'rish. `net.DialTimeout` ichida quyidagi jarayon sodir bo'ladi: SYN yuboradi, SYN-ACK kutadi, ACK yuboradi — bularning barchasi OS kernel darajasida avtomatik. ```go package main import ( "fmt" "net" "time" ) // Portni tekshirish — SYN yuboradi, SYN-ACK kutadi func isPortOpen(host string, port int, timeout time.Duration) bool { address := fmt.Sprintf("%s:%d", host, port) conn, err := net.DialTimeout("tcp", address, timeout) if err != nil { return false // Port yopiq yoki filtrlangan } conn.Close() // FIN yuboradi, ulanishni to'g'ri yopadi return true } func main() { host := "scanme.nmap.org" ports := []int{22, 80, 443, 3389, 8080} for _, port := range ports { if isPortOpen(host, port, 2*time.Second) { fmt.Printf("Port %d: ochiq\n", port) } else { fmt.Printf("Port %d: yopiq\n", port) } } } ``` `net.DialTimeout("tcp", address, timeout)` — bitta qator bilan three-way handshake ni amalga oshiradi. Xatolik yo'q bo'lsa, port ochiq. Timeout xatosi bo'lsa — port filtrlangan (firewall paketni tashlab yuboradi). Boshqa xato — port yopiq (server RST qaytaradi). Natija taxminan bunday ko'rinadi: ``` Port 22: ochiq Port 80: ochiq Port 443: ochiq Port 3389: yopiq Port 8080: yopiq ``` > [!TIP] > `scanme.nmap.org` — Nmap loyihasining rasmiy test serveri. Port skanerlash uchun ruxsat berilgan. Hech qachon boshqa odamning serveri yoki IP'ga ruxsatsiz scan qilmaslik kerak — bu ko'pgina mamlakatlarda noqonuniy. ### Banner grabbing **Banner grabbing** — ochiq portga ulanib, server o'zi haqida qanday ma'lumot beradi, degan savol. Bu pentest'da juda qimmatli texnika: xizmat nomini va versiyasini bilib olsangiz, CVE ma'lumotlar bazasida zaiflik qidira olasiz. SSH, FTP, SMTP kabi xizmatlar ulanish ochilishi bilanoq o'zini tanishtirib, versiyasini yozadi — bu "passive" banner. HTTP esa oldin so'rov kutadi — bu "active" banner. ```go func grabBanner(host string, port int) (string, error) { address := fmt.Sprintf("%s:%d", host, port) conn, err := net.DialTimeout("tcp", address, 3*time.Second) if err != nil { return "", err } defer conn.Close() // O'qish uchun vaqt chegarasi — banner kelmasa 3s dan keyin to'xtatamiz conn.SetReadDeadline(time.Now().Add(3 * time.Second)) buffer := make([]byte, 4096) n, err := conn.Read(buffer) if err != nil { // Ba'zi xizmatlar (masalan HTTP) birinchi so'rovni kutadi conn.Write([]byte("HEAD / HTTP/1.0\r\n\r\n")) conn.SetReadDeadline(time.Now().Add(3 * time.Second)) n, err = conn.Read(buffer) if err != nil { return "", err } } return string(buffer[:n]), nil } func main() { banner, err := grabBanner("scanme.nmap.org", 22) if err != nil { fmt.Println("Xato:", err) return } fmt.Println("Banner:", banner) } ``` SSH portiga ulanish natijasi taxminan: ``` Banner: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1 ``` Bu versiya raqami — `OpenSSH 8.2p1` — CVE ma'lumotlar bazasida qidirish uchun ishlatiladi. Ba'zan eski versiyalarda kritik zaifliklar topiladi. `conn.SetReadDeadline` muhim: agar xizmat hech narsa yubormasa, kod abadiy kutib qolishi mumkin. Deadline qo'ygandan keyin `conn.Read` belgilangan vaqtdan keyin xato qaytaradi. ## Ulanishni yopish (Four-Way Handshake) TCP ulanish ikki tomonlama (full-duplex), shuning uchun yopish ham to'rtta bosqichda amalga oshadi. Bu jarayon biz yozadigan kod uchun avtomatik — `conn.Close()` yoki `defer conn.Close()` buni amalga oshiradi. ```mermaid sequenceDiagram participant C as Client participant S as Server Note over C,S: ESTABLISHED — ma'lumot almashish tugadi C->>S: FIN (seq=500) Note over C: FIN_WAIT_1 S->>C: ACK (ack=501) Note over C: FIN_WAIT_2 Note over S: CLOSE_WAIT S->>C: FIN (seq=800) Note over S: LAST_ACK C->>S: ACK (ack=801) Note over C: TIME_WAIT Note over C,S: CLOSED ``` Nima uchun to'rt bosqich? Chunki ulanish ikki yo'nalishli: Client "men yuborishni tugatdim" deydi (FIN), Server tasdiq beradi (ACK), lekin Server o'zi ham yuborishini tugatishi kerak — shuning uchun alohida FIN yuboradi, Client esa uni tasdiqlaydi. `defer conn.Close()` — Go'da bu to'rt bosqich avtomatik bajariladi. Agar `defer` yozmasangiz, ulanish "yariqlik" qoladi va OS resurslarini band qiladi — buni **resource leak** deyiladi. ## SYN Flood hujumi TCP handshake xususiyatlarini bilgan holda, tajovuzkorlar qanday qilib serverlarni ishdan chiqaradi? **SYN Flood** — eng keng tarqalgan DoS hujumlaridan biri, TCP ning o'ziga xos zaifligini ishlatadi. ```mermaid sequenceDiagram participant A as Tajovuzkor participant S as Server loop Ko'p marta (minglab) A->>S: SYN (soxta IP manzili bilan) Note over S: Xotira ajratadi, ACK kutadi S->>A: SYN-ACK (soxta IP'ga — javobsiz ketadi) Note over S: 60-120 sekund timeout kutadi end Note over S: Barcha ulanish slotlari to'ldi — haqiqiy foydalanuvchilar ulanolmaydi ``` Hujum qanday ishlaydi: tajovuzkor soxta manba IP bilan minglab SYN yuboradi. Server har bir SYN uchun xotiraga "half-open connection" yozadi va ACK kutadi. ACK hech qachon kelmaydi (IP soxta). Vaqt o'tib, server xotirasidagi barcha slotlar band bo'ladi — yangi haqiqiy ulanishlar uchun joy qolmaydi. **Himoya usuli — SYN Cookies**: server xotiraga hech narsa yozmasdan, matematik formula asosida sequence number hisoblaydi. Haqiqiy client ACK bilan bu raqamni qaytarsa, ulanish o'rnatiladi. Xotira faqat ACK kelgandan keyin ajratiladi — soxta SYN uchun hech narsa band qilinmaydi. ## TCP connection lifecycle Pentest da `netstat` yoki `ss` bilan serverda qanday ulanishlar borligini ko'rish mumkin. Holat nomlari TCP lifecycle dan keladi: ```mermaid flowchart TD A[CLOSED] -->|"Server listen()"| B[LISTEN] A -->|"Client connect()"| C[SYN_SENT] B -->|SYN keldi| D[SYN_RECEIVED] C -->|SYN-ACK keldi| E[ESTABLISHED] D -->|ACK keldi| E E -->|Client FIN| F[FIN_WAIT_1] E -->|Server FIN| G[CLOSE_WAIT] F -->|ACK keldi| H[FIN_WAIT_2] H -->|FIN keldi| I[TIME_WAIT] I -->|2MSL timeout| A G -->|Server FIN| J[LAST_ACK] J -->|ACK keldi| A ``` `TIME_WAIT` holati muhim: Client oxirgi ACK ni yuborgandan keyin darhol yopilmaydi. 2MSL (Maximum Segment Lifetime, odatda 60-120s) kutadi — chunki oxirgi ACK yo'qolgan bo'lsa, Server qayta FIN yuboradi va Client hali javob bera olishi kerak. ## Go'da professional port scanner Endi barcha tushunchalarni birlashtirgan, goroutine bilan parallel ishlovchi port scanner yozamiz. Bu keyingi darslarda chuqurroq ko'riladigan skanerlarning asosi. Worker pool pattern ishlatamiz: 100 ta doimiy goroutine navbatdan portlarni oladi. Bu 65535 ta goroutine yaratishdan (OS file descriptor limiti) va sequential skanerlashdan (juda sekin) yaxshiroq muvozanat. ```go package main import ( "fmt" "net" "sort" "sync" "time" ) type ScanResult struct { Port int Open bool Service string Banner string } type PortScanner struct { Host string Timeout time.Duration MaxWorkers int } func NewPortScanner(host string, timeout time.Duration, workers int) *PortScanner { return &PortScanner{Host: host, Timeout: timeout, MaxWorkers: workers} } // worker — jobs channel'dan portlarni olib tekshiradi func (ps *PortScanner) worker(jobs <-chan int, results chan<- ScanResult, wg *sync.WaitGroup) { defer wg.Done() for port := range jobs { results <- ps.scanPort(port) } } func (ps *PortScanner) scanPort(port int) ScanResult { result := ScanResult{Port: port} address := fmt.Sprintf("%s:%d", ps.Host, port) // DialTimeout — ichida three-way handshake bajariladi conn, err := net.DialTimeout("tcp", address, ps.Timeout) if err != nil { // Timeout xatosi = filtered, boshqa xato = closed return result } defer conn.Close() // FIN yuboradi result.Open = true result.Service = knownService(port) result.Banner = grabBannerFromConn(conn) return result } func grabBannerFromConn(conn net.Conn) string { // 2 sekund ichida banner kelmasa — bo'sh qaytaramiz conn.SetReadDeadline(time.Now().Add(2 * time.Second)) buf := make([]byte, 1024) n, _ := conn.Read(buf) return string(buf[:n]) } func knownService(port int) string { services := map[int]string{ 21: "FTP", 22: "SSH", 23: "Telnet", 25: "SMTP", 53: "DNS", 80: "HTTP", 110: "POP3", 143: "IMAP", 443: "HTTPS", 445: "SMB", 3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL", 8080: "HTTP-alt", } if s, ok := services[port]; ok { return s } return "" } // Scan — port diapazonini parallel skanerlaydi func (ps *PortScanner) Scan(start, end int) []ScanResult { jobs := make(chan int, ps.MaxWorkers) results := make(chan ScanResult, ps.MaxWorkers) var wg sync.WaitGroup // MaxWorkers ta goroutine ishga tushadi for i := 0; i < ps.MaxWorkers; i++ { wg.Add(1) go ps.worker(jobs, results, &wg) } // Portlarni navbatga solamiz go func() { for port := start; port <= end; port++ { jobs <- port } close(jobs) // Boshqa port yo'q — workerlar tugatadi }() // Barcha workerlar tugashini kutiб, results ni yopamiz go func() { wg.Wait() close(results) }() var all []ScanResult for r := range results { all = append(all, r) } // Port raqami bo'yicha tartiblaymiz (natijalar tartibsiz keladi) sort.Slice(all, func(i, j int) bool { return all[i].Port < all[j].Port }) return all } func main() { scanner := NewPortScanner("scanme.nmap.org", 2*time.Second, 100) fmt.Printf("Skanerlash boshlandi: %s (1-1000 portlar, 100 worker)\n\n", scanner.Host) start := time.Now() results := scanner.Scan(1, 1000) elapsed := time.Since(start) fmt.Println("PORT HOLAT XIZMAT") fmt.Println("---- ----- ------") openCount := 0 for _, r := range results { if r.Open { openCount++ fmt.Printf("%-9d %-8s %s\n", r.Port, "ochiq", r.Service) if len(r.Banner) > 0 { preview := r.Banner if len(preview) > 60 { preview = preview[:60] + "..." } fmt.Printf(" Banner: %s\n", preview) } } } fmt.Printf("\nJami: %d port tekshirildi, %d ochiq, vaqt: %v\n", len(results), openCount, elapsed) } ``` Sequential skanerda 1000 port × 2s = 2000 sekund (33 daqiqa) ketar edi. Bu kod 100 ta parallel goroutine bilan taxminan 5-10 sekunda yakunlaydi. Channel orqali ma'lumot uzatish xavfsiz — goroutinelar o'rtasida race condition yo'q. > [!NOTE] > Port skanerlashda `sort.Slice` nima uchun kerak? Goroutinelar natijalarni ixtiyoriy tartibda yuborgani uchun. 80-port 22-portdan oldin tugatishi mumkin. Sort bilan natijalar har doim tartibda chiqadi. ## Qisqacha 1. TCP three-way handshake: SYN → SYN-ACK → ACK — ulanish o'rnatiladi. Har bosqich sequence number ni sinxronlashtiradi. 2. Port ochiqligini `net.DialTimeout` orqali tekshiramiz — muvaffaqiyatli ulanish = port ochiq. 3. **Banner grabbing** — versiya ma'lumotini olish, CVE qidirish uchun asosiy texnika. 4. `defer conn.Close()` — four-way handshake'ni avtomatik bajaradi, resource leak bo'lmaydi. 5. **SYN Flood** — soxta IP bilan server resurslarini to'ldirish; SYN Cookies himoya beradi. 6. Worker pool pattern — cheklangan goroutine soni, navbatdan ishlash, optimal tezlik. ## Keyingi qadam Keyingi darsda bu asoslar ustida **professional TCP skaner** yaratamiz: adaptive timeout, filtrlangan portlarni aniqlash, va stealth skanerlash usullarini o'rganamiz.