Web Application Security Fundamentals #11: Web Security Testing Tools & Methodology

Penetration testing memerlukan tools untuk automate reconnaissance, vulnerability scanning, dan exploitation. Modul ini covers tools industri-standard.

Tool Categories

1. Port Scanning & Reconnaissance

nmap

# Scan ports
nmap -p- api.example.com

# Detect services
nmap -sV api.example.com

# Aggressive scan
nmap -A -T4 api.example.com

2. Web Proxy & Interception

Burp Suite Community (Free)

1. Launch Burp → Configure browser proxy (127.0.0.1:8080)
2. Browser navigate to target
3. Burp intercepts & logs all requests
4. Modify request, replay, analyze response
5. Use Intruder untuk automate fuzzing
6. Use Scanner untuk vulnerability detection

OWASP ZAP (Free, Open-Source)

# Start ZAP
zaproxy

# Baseline scan
zaproxy -cmd -quickurl https://api.example.com -quickout report.html

3. Vulnerability Scanners

SQLMap (SQL Injection)

# Test parameter
sqlmap -u "https://api.example.com/search?q=test" --dbs

# Aggressive scan
sqlmap -u "https://api.example.com/search?q=test" --risk=3 --level=5

WPScan (WordPress specific)

# Scan WordPress
wpscan --url https://example.com

# Enumerate users
wpscan --url https://example.com --enumerate u

4. HTTP Utilities

curl (basics)

# GET request
curl https://api.example.com/users

# POST with data
curl -X POST https://api.example.com/login -d "email=user@example.com&pass=password"

# Inspect headers
curl -I https://api.example.com

# Custom header
curl -H "Authorization: Bearer TOKEN" https://api.example.com/me

Postman (API testing)

• GUI-based HTTP client
• Save requests & environments
• Pre/post-request scripts
• Collection automation

5. Password Testing

Hydra (Brute force login)

hydra -l admin -P passwords.txt -s 80 http-post-form "https://example.com/login:user=^USER^&pass=^PASS^:F=Invalid"

John the Ripper (Hash cracking)

john --wordlist=rockyou.txt hashes.txt

Testing Workflow

Phase 1: Reconnaissance

# 1. nmap port scan
nmap -p- target.com

# 2. Identify services
nmap -sV target.com

# 3. Enumerate web paths
ffuf -u https://target.com/FUZZ -w common.txt

Phase 2: Vulnerability Discovery

# 1. Use Burp Suite / ZAP to intercept requests
# 2. Send to Scanner for automated scanning
# 3. Analyze results, identify false positives

# Common vulns to test:
# - SQL Injection
# - XSS
# - CSRF
# - Broken Access Control
# - XXE
# - Insecure Deserialization

Phase 3: Exploitation & PoC

1. Confirm vulnerability with manual test
2. Develop Proof of Concept
3. Document impact (data accessed, functionality compromised)
4. Generate evidence (screenshots, logs)

Phase 4: Reporting

Report struktur:
- Executive Summary
- Risk Rating (CVSS)
- Vulnerability Description
- Steps to Reproduce
- Proof of Concept
- Remediation
- References

CVSS Scoring

Common Vulnerability Scoring System (CVSS) 3.1:

Score Range: 0.0 - 10.0

• 0.0: None
• 0.1-3.9: Low
• 4.0-6.9: Medium
• 7.0-8.9: High
• 9.0-10.0: Critical

Components:

• Attack Vector (AV): Local, Adjacent, Network
• Attack Complexity (AC): Low, High
• Privileges Required (PR): None, Low, High
• User Interaction (UI): None, Required
• Scope (S): Unchanged, Changed
• Confidentiality (C): None, Low, High
• Integrity (I): None, Low, High
• Availability (A): None, Low, High

Example:

SQL Injection on login: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Score: 9.8 (Critical)

Ethical Hacking Rules

✅ DO:

• Get written authorization before testing
• Test only systems you own or have explicit permission
• Document all findings
• Maintain confidentiality of sensitive data
• Report responsibly (give time to fix before disclosure)

❌ DON'T:

• Test production systems without approval
• Access data beyond what's needed for PoC
• Disrupt service or availability
• Share findings publicly before fix
• Use exploits for personal gain

Kesimpulan

Tools mempercepat testing, tapi skill & knowledge lebih penting. Tools tanpa understanding = dangerous.

Modul berikutnya (#12) membahas Secure Coding Practices.

Next: #12 - Secure Coding Practices