# HTTP API Chaqirish ## Bu darsda nima qilamiz? REST API — zamonaviy web dasturlarning aloqa tili. Bu darsda GitHub API bilan real ishlashni ko'ramiz, turli autentifikatsiya usullarini (API Key, Bearer Token, Basic Auth, OAuth) o'rganamiz, va rate limiting hamda exponential backoff bilan profesional ishlovchi client yozamiz. Pentest'da bu bilimlar autentifikatsiyali endpointlarni test qilish, OSINT ma'lumot to'plash va zaiflik qidirish uchun kerak. ## REST API nima? **REST (Representational State Transfer)** — HTTP asosidagi API dizayn yondashuvi. Asosiy printsipi: har bir so'rov mustaqil (**stateless**), server oldingi so'rovlarni eslamaydi. Ma'lumotlar `JSON` formatida almashinadi. REST URL'lari resurslarni ifodalaydi: ``` GET /users/123 → ID=123 foydalanuvchini o'qish POST /users → Yangi foydalanuvchi yaratish PUT /users/123 → ID=123 foydalanuvchini yangilash DELETE /users/123 → ID=123 foydalanuvchini o'chirish GET /users/123/posts → Foydalanuvchining postlari ``` Bu pattern'ni bilgan holda, API dokumentatsiyasi ko'rmasdan ham endpointlarni taxmin qilish mumkin. Pentest'da bu **endpoint enumeration** uchun asosdir. Stateless nima degani? Server har so'rovda autentifikatsiyani tekshiradi — "men avvalgi so'rovdan bilaman" deb aytmaydi. Shuning uchun har so'rovda token yoki cookie yuboriladi. ## GitHub API bilan ishlash GitHub API — o'rganish uchun ideal: bepul, yaxshi hujjatlashtirilgan, rate limiting mavjud (xato qilishni ko'rsatadi), autentifikatsiyasiz ham ishlaydigan endpoint'lar bor. OSINT uchun ham foydali: pentest qilayotgan kompaniyaning GitHub'ini tekshirish — qaysi texnologiyalar ishlatiladi, kimlar ishlaydi, secrets leak bo'lganmi? ```go package main import ( "encoding/json" "fmt" "log" "net/http" "time" ) // GitHubUser — API javobidan keladigan foydalanuvchi ma'lumotlari type GitHubUser struct { Login string `json:"login"` // @username Name string `json:"name"` // To'liq ism Company string `json:"company"` // Kompaniya Location string `json:"location"` // Joylashuv PublicRepos int `json:"public_repos"` // Ochiq repolar soni Followers int `json:"followers"` // Kuzatuvchilar CreatedAt string `json:"created_at"` // Yaratilgan sana } func getGitHubUser(username string) (*GitHubUser, error) { // URL'ni dinamik yaratamiz url := fmt.Sprintf("https://api.github.com/users/%s", username) resp, err := http.Get(url) if err != nil { return nil, fmt.Errorf("tarmoq xatosi: %w", err) } defer resp.Body.Close() // Status kodlarni alohida tekshiramiz — har xil xato xar xil ma'no if resp.StatusCode == 404 { return nil, fmt.Errorf("foydalanuvchi topilmadi: %s", username) } if resp.StatusCode == 429 { return nil, fmt.Errorf("rate limit: biroz kuting") // 60 so'rov/soat } if resp.StatusCode != http.StatusOK { return nil, fmt.Errorf("API xatosi: %s", resp.Status) } // json.NewDecoder — stream orqali o'qish (io.ReadAll dan samaraliroq) var user GitHubUser if err := json.NewDecoder(resp.Body).Decode(&user); err != nil { return nil, fmt.Errorf("JSON parsing: %w", err) } return &user, nil } func main() { user, err := getGitHubUser("golang") if err != nil { log.Fatal(err) } fmt.Printf("Login: %s\n", user.Login) fmt.Printf("Kompaniya: %s\n", user.Company) fmt.Printf("Repolar: %d\n", user.PublicRepos) fmt.Printf("Followers: %d\n", user.Followers) fmt.Printf("A'zo bo'lgan: %s\n", user.CreatedAt) } ``` Bu kod `golang` foydalanuvchi uchun taxminan quyidagini chiqaradi: ``` Login: golang Kompaniya: Google Repolar: 30 Followers: 6890 A'zo bo'lgan: 2009-11-03T22:00:10Z ``` `json.NewDecoder(resp.Body).Decode(&user)` — stream orqali o'qish. `io.ReadAll` dan farqi: butun javobni xotiraga yuklashdan avval, qismma-qism o'qiydi. Katta javoblar uchun (10MB+ JSON) bu muhim. ### Foydalanuvchi repolarini olish Bir foydalanuvchining barcha repolarini olish — OSINT va kompaniya texnologiyasini aniqlashda foydali: ```go type GitHubRepo struct { Name string `json:"name"` Language string `json:"language"` StarCount int `json:"stargazers_count"` Description string `json:"description"` UpdatedAt string `json:"updated_at"` } func getUserRepos(username string) ([]GitHubRepo, error) { // per_page=100 — sahifadagi max natijalar (100 dan ko'p bo'lsa pagination kerak) url := fmt.Sprintf("https://api.github.com/users/%s/repos?per_page=100", username) resp, err := http.Get(url) if err != nil { return nil, err } defer resp.Body.Close() if resp.StatusCode != http.StatusOK { return nil, fmt.Errorf("API error: %s", resp.Status) } // Javob array — []GitHubRepo ga decode qilamiz var repos []GitHubRepo if err := json.NewDecoder(resp.Body).Decode(&repos); err != nil { return nil, err } return repos, nil } ``` ## Autentifikatsiya usullari Ko'pchilik API'lar autentifikatsiya talab qiladi. Pentest'da qaysi usul ishlatilganini bilish muhim — har birining o'ziga xos zaifliklarini tekshirish mumkin. ### API Key Eng oddiy usul — header'ga kalit qo'shiladi. API Key — server tomonidan berilgan uzoq muddatli token. Ko'p xizmatlar (Shodan, VirusTotal, Censys) shu usulni ishlatadi. ```go type APIClient struct { baseURL string apiKey string client *http.Client } func NewAPIClient(baseURL, apiKey string) *APIClient { return &APIClient{ baseURL: baseURL, apiKey: apiKey, client: &http.Client{Timeout: 30 * time.Second}, } } // get — barcha GET so'rovlar uchun yagona nuqta func (c *APIClient) get(path string) (*http.Response, error) { req, err := http.NewRequest("GET", c.baseURL+path, nil) if err != nil { return nil, err } // Har xil API'lar har xil header ishlatadi — API hujjatini tekshiring req.Header.Set("X-API-Key", c.apiKey) // Boshqa variantlar: // req.Header.Set("Authorization", "ApiKey "+c.apiKey) // req.Header.Set("api-key", c.apiKey) // URL parametr: url+"?key="+c.apiKey req.Header.Set("User-Agent", "OffensiveGo/1.0") req.Header.Set("Accept", "application/json") return c.client.Do(req) } // Foydalanish func main() { // apiKey qiymatini kodga yozmaslik kerak — environment variable ishlatamiz apiKey := os.Getenv("SHODAN_API_KEY") client := NewAPIClient("https://api.shodan.io", apiKey) resp, err := client.get("/shodan/host/8.8.8.8") if err != nil { log.Fatal(err) } defer resp.Body.Close() var result map[string]interface{} json.NewDecoder(resp.Body).Decode(&result) fmt.Printf("Ports: %v\n", result["ports"]) } ``` > [!WARNING] > API kalitni kodga yozmaslik kerak. Foydalaning: `apiKey := os.Getenv("API_KEY")`. Git'ga commit qilingan kalit — katta xavf. GitHub'da har kuni minglab kalitlar topiladi va suiiste'mol qilinadi. ### Bearer Token (JWT) Login qilganda token olinadi, keyingi so'rovlarda `Authorization: Bearer ` header bilan yuboriladi. JWT (JSON Web Token) — ichida foydalanuvchi ma'lumotlari saqlanadigan, imzolangan token. ```go type AuthClient struct { baseURL string token string client *http.Client } // Login — token olish func (c *AuthClient) Login(username, password string) error { payload := map[string]string{ "username": username, "password": password, } data, _ := json.Marshal(payload) resp, err := c.client.Post( c.baseURL+"/auth/login", "application/json", bytes.NewBuffer(data), ) if err != nil { return err } defer resp.Body.Close() if resp.StatusCode != http.StatusOK { return fmt.Errorf("login xato: %s", resp.Status) } // Token javobdan olinadi var result struct { Token string `json:"token"` ExpiresIn int `json:"expires_in"` // Token qachon eskiradi } if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { return err } c.token = result.Token fmt.Printf("Token olindi, %d sekund amal qiladi\n", result.ExpiresIn) return nil } // doAuth — autentifikatsiyali so'rov func (c *AuthClient) doAuth(method, path string) (*http.Response, error) { req, err := http.NewRequest(method, c.baseURL+path, nil) if err != nil { return nil, err } // "Bearer " prefiksi majburiy req.Header.Set("Authorization", "Bearer "+c.token) return c.client.Do(req) } // Foydalanish func main() { client := &AuthClient{ baseURL: "https://api.example.com", client: &http.Client{Timeout: 10 * time.Second}, } if err := client.Login("admin", "password123"); err != nil { log.Fatal(err) } // Himoyalangan endpoint'ga murojaat resp, err := client.doAuth("GET", "/api/protected/users") if err != nil { log.Fatal(err) } defer resp.Body.Close() fmt.Printf("Status: %s\n", resp.Status) } ``` JWT tokenining ichida ma'lumot bor — bu muhim zaiflik: `base64` decode qilsangiz, foydalanuvchi ma'lumotlari ko'rinadi. Pentest'da JWT imzosi tekshirilmasligini ham sinab ko'rish kerak (algorithm confusion, `alg: none`). ### Basic Auth Username va parol Base64 da kodlanib, header'ga yoziladi: `Authorization: Basic base64(user:pass)`. Eski tizimlar va ba'zi admin panellar shu usulda ishlaydi. ```go func (c *APIClient) doBasicAuth(method, path, username, password string) (*http.Response, error) { req, err := http.NewRequest(method, c.baseURL+path, nil) if err != nil { return nil, err } // Go standart kutubxonasi Base64 encoding'ni o'zi qiladi req.SetBasicAuth(username, password) // Header natijasi: Authorization: Basic YWRtaW46c2VjcmV0 return c.client.Do(req) } ``` > [!CAUTION] > Basic Auth parolni faqat Base64 qiladi — bu shifrlash emas, har kim decode qila oladi. Faqat HTTPS bilan ishlating. HTTP + Basic Auth = parol ochiq uzatiladi. Basic Auth brute-force uchun ham qulay — har so'rovda `username:password` juftligini tekshirish mumkin. Keyingi modullarda bu ko'riladi. ## Rate limiting Ko'p API'lar bir vaqtda yuborilgan so'rovlar sonini cheklaydi (sekundiga yoki soatiga). Chekdan oshganda `429 Too Many Requests` qaytaradi. Rate limitni buzish — ban bo'lish, token o'chirilishi demak. `golang.org/x/time/rate` paketi **token bucket** algoritmini ishlatadi: xolda tokenlar to'planadi, har so'rov bir token sarflaydi. Token yo'q bo'lsa — so'rov kutadi. ```go import ( "context" "golang.org/x/time/rate" ) type RateLimitedClient struct { client *http.Client limiter *rate.Limiter } // NewRateLimitedClient — sekundiga requestsPerSecond ta so'rov func NewRateLimitedClient(requestsPerSecond int) *RateLimitedClient { return &RateLimitedClient{ client: &http.Client{Timeout: 10 * time.Second}, // rate.Limit(5) = sekundiga 5 ta // burst=requestsPerSecond: bir anda shuncha so'rov yuborsa bo'ladi limiter: rate.NewLimiter(rate.Limit(requestsPerSecond), requestsPerSecond), } } // Do — so'rov yuborishdan oldin ruxsat kutadi func (c *RateLimitedClient) Do(req *http.Request) (*http.Response, error) { // limiter.Wait — token bo'lguncha bloklaydi (goroutine'ni uxlatadi) if err := c.limiter.Wait(context.Background()); err != nil { return nil, err } return c.client.Do(req) } func main() { client := NewRateLimitedClient(5) // Sekundiga 5 ta so'rov start := time.Now() for i := 0; i < 20; i++ { req, _ := http.NewRequest("GET", "https://api.github.com/users/golang", nil) resp, err := client.Do(req) if err != nil { log.Fatal(err) } resp.Body.Close() fmt.Printf("So'rov %d: %v dan keyin\n", i+1, time.Since(start).Round(time.Millisecond)) } // Natija: 20 so'rov / 5 req/sec = ~4 sekund } ``` Natija taxminan: ``` So'rov 1: 0ms dan keyin So'rov 5: 200ms dan keyin So'rov 10: 1.8s dan keyin So'rov 15: 2.8s dan keyin So'rov 20: 3.8s dan keyin ``` Rate limiter birinchi 5 ta so'rovni darhol o'tkazadi (burst), keyin har 200ms da bitta qo'yadi. ## Retry va exponential backoff Server vaqtinchalik yetishmovchi (5xx xato) bo'lsa, qayta urinish kerak. Lekin darhol qayta urinsangiz, server yukini oshirasiz — bu DoS ga o'xshab ketadi. **Exponential backoff** — har urinish orasida kutish vaqtini ikki barobar oshirish: ``` Urinish 1: xato → 1 sekund kutish Urinish 2: xato → 2 sekund kutish Urinish 3: xato → 4 sekund kutish Urinish 4: xato → 8 sekund kutish Urinish 5: yoki muvaffaqiyat, yoki to'xtash ``` ```go func doWithRetry(client *http.Client, req *http.Request, maxRetries int) (*http.Response, error) { for attempt := 0; attempt <= maxRetries; attempt++ { resp, err := client.Do(req) // Muvaffaqiyat yoki client xatosi (4xx) — qayta urinsak foyda yo'q if err == nil && resp.StatusCode < 500 { return resp, nil } if resp != nil { resp.Body.Close() log.Printf("Urinish %d: HTTP %d", attempt+1, resp.StatusCode) } else { log.Printf("Urinish %d: %v", attempt+1, err) } if attempt == maxRetries { return nil, fmt.Errorf("barcha %d urinish xato", maxRetries+1) } // 1 << attempt = 2^attempt: 1, 2, 4, 8 sekund... wait := time.Duration(1<= 300 { body, _ := io.ReadAll(resp.Body) return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body)) } return json.NewDecoder(resp.Body).Decode(result) } // POST — body yuboradi, javobni result'ga decode qiladi func (c *APIClient) POST(path string, body, result interface{}) error { resp, err := c.doRequest("POST", path, body) if err != nil { return err } defer resp.Body.Close() if resp.StatusCode < 200 || resp.StatusCode >= 300 { data, _ := io.ReadAll(resp.Body) return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(data)) } if result != nil { return json.NewDecoder(resp.Body).Decode(result) } return nil } // Foydalanish misoli func main() { client := NewAPIClient("https://api.example.com", "my-api-key", 5) // GET: foydalanuvchi olish var user map[string]interface{} if err := client.GET("/v1/users/123", &user); err != nil { log.Fatal(err) } fmt.Printf("User: %v\n", user["name"]) // POST: yangi foydalanuvchi newUser := map[string]string{ "name": "Test User", "email": "test@example.com", } var created map[string]interface{} if err := client.POST("/v1/users", newUser, &created); err != nil { log.Fatal(err) } fmt.Printf("Yaratildi: %v\n", created["id"]) } ``` Bu client bilan ishlash sodda: `client.GET(path, &result)` — ichida rate limit, retry, header, error handling barchasi bor. Keyingi darslardagi Shodan va boshqa integratsiyalar shu pattern ustiga quriladi. ## Qisqacha 1. REST API — URL = resurs, metod = amal, stateless. 2. **API Key** — `X-API-Key` header. Kalitni `os.Getenv()` orqali oling, kodga yozmang. 3. **Bearer Token** — `Authorization: Bearer `, login'dan keyin olinadi. 4. **Basic Auth** — `req.SetBasicAuth()`, faqat HTTPS bilan. 5. **Rate limiter** — `golang.org/x/time/rate`, sekundiga so'rov soni cheklash. 6. **Retry + backoff** — 5xx xatolarda `1<