| کانال امنیت و شبکه |

add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy \
  "default-src 'self'; script-src 'self'; object-src 'none'" always;

hydra -L users.txt -P passwords.txt \
  -t 4 -W 3 -f -vV ssh://192.168.1.10

sudo apt update
sudo apt install wireguard -y

cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key

wg genkey | tee client_private.key | wg pubkey > client_public.key

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key_here>

[Peer]
PublicKey = <client_public_key_here>
AllowedIPs = 10.0.0.2/32

[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key_here>
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public_key_here>
Endpoint = <your_server_ip>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

sudo wg-quick up wg0

sudo systemctl enable wg-quick@wg0

ping 10.0.0.1

import psycopg2

conn = psycopg2.connect(...)
cur = conn.cursor()

# ❌ اشتباه (ساخت query با string)
username = input("username: ")
q_bad = f"SELECT * FROM users WHERE username = '{username}'"
cur.execute(q_bad)  # آسیب‌پذیر به SQL Injection

# ✅ درست (استفاده از placeholder)
q_ok = "SELECT * FROM users WHERE username = %s"
cur.execute(q_ok, (username,))  # پارامتر جدا ارسال می‌شود
rows = cur.fetchall()

add_header Strict-Transport-Security \
    "max-age=31536000; includeSubDomains; preload" always;

sudo apt update
sudo apt install nikto

nikto -h http://192.168.1.10

nikto -h 192.168.1.10 -p 8080

nikto -h 192.168.1.10 \
  -o report.html -Format html

nikto -h 192.168.1.10 -vhost example.com

sudo apt install tcpdump     # روی Debian/Ubuntu
sudo yum install tcpdump     # روی CentOS/RHEL قدیمی
sudo dnf install tcpdump     # روی Fedora/RHEL جدید

sudo tcpdump -i eth0

sudo tcpdump -i eth0 tcp port 22 and 'tcp[tcpflags] & (tcp-syn) != 0'

sudo tcpdump -i eth0 port 22 -w ssh_traffic.pcap

sudo tcpdump -i eth0 port 22 -c 200

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;

sudo nginx -t
sudo systemctl reload nginx

sudo iptables -F
sudo iptables -X

# اجازه به ترافیک لوکال
sudo iptables -A INPUT -i lo -j ACCEPT

# اجازه به کانکشن‌های جاری و مرتبط
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# اجازه به SSH روی پورت 22
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# اجازه به HTTP
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# اجازه به HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop کردن بقیه ترافیک ورودی
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

sudo iptables -L -n -v

sudo apt-get install iptables-persistent
sudo netfilter-persistent save

nmap -Pn -sS -F 192.168.1.10

nmap -sV 192.168.1.10

nmap --script http-vuln* -p80,443 192.168.1.10

nmap -sS -T2 192.168.1.0/24