Hasil Pencarian  ::  Simpan CSV :: Kembali

"Pengujian penetrasi merupakan suatu langkah penting yang diambil untuk meningkatkan keamanan sebuah website, terutama bagi suatu perusahaan. Terdapat beberapa kerangka kerja dan metodologi untuk uji penetrasi, salah satunya adalah Information Systems Security Assessment Framework (ISSAF). ISSAF merupakan sebuah kerangka kerja yang komprehensif dengan keunggulan pada domain coverage sehingga memungkinkan pengujian bukan hanya dari luar sistem, namun juga masuk ke dalam sistem. Penelitian ini menunjukan tahapan uji penetrasi menggunakan kerangka kerja ISSAF dan memanfaatkan beberapa tools yang umum digunakan untuk mengidentifikasi kerentanan website bagi perusahaan. Hasil dari penelitian ini ditemukan 7 kerentanan, diantaranya yaitu Clickjacking, Brute-force Attack pada Login Page, HSTS Missing From HTTP Server, Content Security Policy (CSP) Header Not Set , Cookie without SameSite Attribute, Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s),serta X-Content-Type-Options Header Missing. Dari hasil pengujian penetrasi ini dapat dijadikan rekomendasi untuk mengatasi kerentanan keamanan pada perusahaan-perusahaan di bidangnya.

---

Penetration testing is an important step taken to improve the security of a website, especially for a company. There are several frameworks and methodologies for penetration testing, one of which is the Information Systems Security Assessment Framework. (ISSAF). ISSAF is a comprehensive framework with advantages on domain coverage that allows testing not only from outside the system, but also into the system.  This research demonstrates the stage of penetration testing using the ISSAF framework and utilizes several commonly used tools to identify website vulnerabilities for companies. This study we found seven vulnerabilities in the target website, including Clickjacking, Brute-force Attack on Login Page, HSTS Missing from HTTP Server, Content Security Policy (CSP) Header Not Set, Cookie without SameSite Attribute, Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s), and X-Content-Type-Options Header Missing. From this penetration test results, a recommendation to address security vulnerabilities in companies can be conducted."

"Ancaman keamanan terhadap website biasa dihasilkan melalui celah yang memungkinkan pengguna lain melakukan tindak kejahatan. Untuk pemeliharaan keamanan website yang baik, deteksi kerentanan website dapat dilakukan dengan prosedur vulnerability identification dan penetration testing. Penetration Testing Execution Standard (PTES) digunakan pada penelitian ini sebagai kerangka kerja atau framework penetration testing dengan tujuan untuk mendapatkan hasil akhir berupa kerentanan yang dapat mengganggu keamanan website. Terdapat tujuh tahapan yang akan dilakukan pada framework PTES yaitu Pre-engagement Interactions, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post Exploitation, dan Reporting. Penetration testing ini juga menerapkan metode blackbox testing. Blackbox testing adalah metode pengujian yang dilakukan tanpa mengetahui informasi apa pun mengenai sistem website. Ditemukan tiga kerentanan dengan tingkat risiko tinggi pada website redstorm setelah melakukan penetration testing dengan framework PTES dan metode blackbox testing, yaitu PII Disclosure, SQL Injection, dan SQL Injection-SQLite. Hasil ini menekankan perlunya penguatan keamanan website dan penerapan langkah-langkah mitigasi yang sesuai untuk melindungi data sensitif dan melawan potensi serangan. Selain itu, penelitian ini menegaskan efektivitas dan relevansi kerangka kerja PTES dalam mengidentifikasi kerentanan keamanan sistem. Implikasi dari temuan ini memberikan kontribusi bagi pengembangan kebijakan keamanan informasi dan penelitian tentang keamanan siber yang lebih lanjut.

---

Security threats to common websites are generated by gaps that allow other users to commit criminal acts. For good website security maintenance, website vulnerability detection can be done with vulnerability identification and penetration testing procedures. The Penetration Testing Execution Standard (PTES) is used in this research as a framework for penetration testing with the aim of obtaining the final result of vulnerabilities that can interfere with the operation of the website. There are seven stages that will be performed on the PTES framework: Pre-engagement Interactions, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-exploitation, and Reporting. The penetration test also uses the blackbox testing method. Blackbox testing is a test method that is performed without knowing any information about the website system. Three high-risk vulnerabilities were found on Redstorm websites after performing penetration testing with the PTES framework and blackbox testing methods, namely PII Disclosure, SQL Injection, and SQL injection-SQLite. The results emphasize the need to strengthen website security and implement appropriate mitigation measures to protect sensitive data and counter potential attacks. In addition, the study confirms the effectiveness and relevance of the PTES framework in identifying system security vulnerabilities. The implications of these findings contribute to the development of information security policies and further research on cybersecurity."

"Dengan adanya perkembangan teknologi saat ini, banyak pihak memberikan layanan yang dapat dimanfaatkan untuk dapat mempermudah semua kegiatan. Salah satu media yang digunakan untuk berbagai tujuan yaitu website. Salah satu jenis website yaitu website e-learning. Website e learning akan akan menyimpan informasi sensitif seperti data penggunanya untuk dapat memberikan hak akses fasilitas terhadap website tersebut. Informasi sensitif inilah yang perlu diperhatikan dalam pengembangan suatu website agar terhindar dari serangan cyber. Salah satu serangan yang sering terjadi pada website yaitu sql injection, dimana serangan ini terjadi dalam bentuk pencurian atau bahkan memodifikasi informasi pribadi oleh pihak yang tidak berhubungan. Untuk mencegah terjadi serangan pada website maka perlu dilakukannya penetration testing. Penetration testing bertujuan untuk mencari kerentanan yang ada pada website agar dapat segera ditangani sebelum dimanfaatkan oleh pihak yang tidak bertanggung jawab. Terdapat beberapa tahapan yang dilakukan untuk mengidentifikasi kerentanan website yaitu reconnaissance, scanning, exploitation dan report. Pengujian dilakukan dengan menganalisis hasil yang didapatkan dari setiap tahapan penetration testing sehingga dapat diketahui kerentanan yang ada pada website. Dari kerentanan yang terdetaksi maka akan diketahui beberapa rekomendasi solusi untuk mengatasinya. Setiap tahapan penetration testing akan menggunakan beberapa tools pendukung. Selain itu juga dilakukan pengujian keamanan website dengan melakukan serangan sql injection dan xss attack.

---

With the current technological developments, many parties provide services that can be used to facilitate all activities. One of the media used for various purposes is the website. One type of website is an e-learning website. An e-learning website will store sensitive information such as user data to be able to grant facility access rights to the website. This sensitive information needs to be considered in developing a website to avoid cyber attacks. One of the attacks that often occurs on websites is sql injection, where this attack occurs in the form of stealing or even modifying personal information by unrelated parties. To prevent attacks on the website, it is necessary to do penetration testing. Penetration testing aims to find vulnerabilities on the website so that they can be addressed immediately before being exploited by irresponsible parties. There are several steps taken to identify website vulnerabilities, namely reconnaissance, scanning, exploitation and reports. Testing is carried out by analyzing the results obtained from each stage of penetration testing so that the vulnerabilities that exist on the website can be identified. From the detected vulnerabilities, several recommendations for solutions to overcome them will be identified. Each stage of penetration testing will use several supporting tools. Besides that, website security testing is also carried out by carrying out sql injection attacks and xss attacks."

"

Pertumbuhan penggunaan Windows 11 mendorong perlunya evaluasi terhadap sistem operasi ini. Meski merupakan pembaruan dari Windows 10, fokus utama tetap pada risiko keamanan karena meningkatnya serangan siber. Banyak serangan terjadi di tingkat endpoint, sehingga perlindungan pengguna dan data sangat penting. Penelitian ini mengevaluasi kerentanan keamanan dan potensi serangan pada Windows 11 Home dan Enterprise menggunakan metode Information System Security Assessment Framework (ISSAF). Hasilnya menunjukkan adanya kerentanan signifikan pada protokol SMB dan RDP, dengan Windows 11 Enterprise lebih rentan terhadap serangan tertentu seperti SMB Relay Attack. Risiko lain termasuk potensi instalasi backdoor. Rekomendasi mitigasi meliputi pengaktifan SMB Signing, kebijakan kata sandi kompleks, penonaktifan RDP jika tidak digunakan, dan pengaktifan antivirus. Penelitian ini memberikan wawasan berharga untuk meningkatkan keamanan Windows 11

---

The growth in Windows 11 usage necessitates an evaluation of this operating system. Despite being an update from Windows 10, the main focus remains on security risks due to the increasing complexity of cyber attacks. Many attacks occur at the endpoint level, making user and data protection crucial. This study evaluates security vulnerabilities and potential attacks on Windows 11 Home and Enterprise using the Information System Security Assessment Framework (ISSAF) method. The results show significant vulnerabilities in the SMB and RDP protocols, with Windows 11 Enterprise being more susceptible to certain attacks such as SMB Relay Attack. Other risks include potential backdoor installations. Recommended mitigations include enabling SMB Signing, implementing complex password policies, disabling RDP if not in use, and activating antivirus software. This research provides valuable insights for enhancing the security of Windows 11.

"

"Berkembang pesatnya teknologi informasi saat ini sejalan dengan berkembangnya aplikasi berbasis android dan website. Website umumnya digunakan sebagai media informasi dan komunikasi yang tentunya memiliki peran yang sangat penting. Namun, tidak menutup kemungkinan bahwa terdapat ancaman terkait dengan celah keamanan dari suatu website, baik kejahatan cyber, kebocoran data, pencurian data, dan merusak data maupun hanya ingin mengganggu system tersebut. Sebagai contoh pada website admin Digital Outlet yang merupakan pusat dari pengelolaan suatu website application. Dalam website admin tersebut telah tersimpan data dan informasi penting penggunanya yang bersifat sensitif. Maka, perlu adanya perhatian khusus terkait keamanan website tersebut. Pada penelitian ini akan dilakukan vulnerability assessment dan penetration testing pada situs website Digital Outlet menggunakan metode Information System Security Assessment Framework (ISSAF) dengan melakukan pengujian untuk mencari celah keamanan yang umum terjadi pada website tersebut, khususnya celah keamanan pada Broken Access Control, Cross Site Scripting (XSS), SQL Injection, dan sebagainya. Hasil dari penelitian analisis uji kerentanan yang diperoleh pada website Digital Outlet nantinya akan pergunakan untuk memperbaiki dan meningkatkan keamanan pada website tersebut serta menjadi salah satu referensi dalam memberikan rekomendasi terkait pengembangan framework Basic Development Framework (BDF) untuk management struktur rancang bangun suatu website yang baik dan aman. 

---

The rapid development of information technology is currently in line with the development of Android-based applications and website. Website are generally used as a medium of information and communication which of course has a very important role. However, it is possible that there are threats related to the security gaps of a website, both cyber crime, data leaks, data theft, and damage to data or just wanting to disrupt the system. For example, on the Digital Outlet admin website, which is the center of managing a website application. The admin website has stored important sensitive data and information on its users. So, there needs to be special attention regarding the security of the website. In this research, vulnerability assessment dan penetration testing will be carried out on the Digital Outlet website using the Information System Security Assessment Framework (ISSAF) method by conducting tests to find security holes that commonly occur on the website, especially security holes in Broken Access Control, Cross Site Scripting (XSS), SQL Injection, and so on. The results of the vulnerability test analysis research obtained on the Digital Outlet website will later be used to improve and increase security on the website and become a reference in providing recommendations related to the development of the Basic Development Framework (BDF) framework for the management structure of a good website design and build safe."

"Kemajuan internet kian membuat segala hal serba mudah dan cepat, contohnya yaitu banyaknya kemunculan berbagai jenis website saat ini, baik e-commerce, blog, instansi atau organisasi, dan sebagainya. Salah satu contohnya yaitu adanya website donasi online seperti bukadonasi.com yang menjadi wadah beramal bagi masyarakat. Masyarakat yang ingin membuka donasi perlu registrasi dengan menyertakan data pribadi. Apabila web server dari website donasi online tidak memiliki keamanan yang baik, maka resiko dari pihak yang tidak bertanggung jawab untuk memberi ancaman lewat celah keamanan website tersebut menjadi besar. Data pribadi yang disimpan bukadonasi.com juga memiliki potensi untuk disusupi atau dicuri. Tujuan dari penelitian ini yaitu untuk melakukan antisipasi keamanan dari kerentanan dan ancaman yang ada pada website bukadonasi.com dengan melakukan uji penetrasi menggunakan kerangka Information System Security Assessment Framework (ISSAF). ISSAF memiliki beberapa keunggulan dibandingkan kontrol keamanan lainnya karena ISSAF melakukan pengujian dengan masuk ke dalam sistem target juga. Dari hasil pengujian penetrasi tersebut akan didapatkan rekomendasi kemanan sistem informasi website bukadonasi.com.

---

The development of the internet is growing rapidly then making everything easy and fast, for example, the emergence of various types of websites today, whether e-commerce, blogs, agencies or organizations, and so on. One example is the existence of online donation websites such as Bukadonasi.com, which is a place of charity for people. People who want to open donations need to register by including personal data. If the web server of the online donation website does not have good security, then the risk from an irresponsible people to pose a threat through the website's security gap becomes large. Personal data stored by Bukadonasi.com also has the potential to be compromised or stolen. The purpose of this research is to anticipate security from vulnerabilities and threats that exist on the Bukadonasi.com website by conducting a penetration test using the Information System Security Assessment Framework (ISSAF). ISSAF has several advantages over other security controls because ISSAF also performs testing by logging into the target system as well. From the results of the penetration test, recommendations for the security of the information system of the Bukadonasi.com website will be obtained."

"ABSTRAKJaringan nirkabel atau wireless adalah salah satu media atau sistem transmisi data yang menggunakan gelombang radio sebagai media transmisinya dan sebuah pengembangan dari jaringan komputer yang sebelumnya menggunakan kabel sebagai media penghubungnya. Nirkabel memanfaatkan udara/gelombang elektromagnetik sebagai media lalu lintas pertukaran data. Namun seiring perkembangannya, keamanan pada jaringan nirkabel ternyata cukup rentan, dan memberikan potensi yang cukup tinggi bagi para hacker. Keamanan jaringan mempunyai dampak yang besar bagi dunia terhadap penggunaannya, seluruh informasi dapat dikirimkan dan diterima tanpa menggunakan kabel. Jaringan nirkabel menyediakan semua fungsi yang sama seperti jaringan kabel tanpa adanya perangkat fisik. Tujuan utama dari studi ini ialah mendemonstrasikan dan menganalisis jenis variasi serangan yang dapat ditemui saat menggunakan jaringan nirkabel sekaligus mitigasi terhadap serangan yang terjadi. Jaringan nirkabel memiliki banyak celah dalam penggunaannya. Pada studi kali ini akan digunakan software yaitu Kali Linux 3.0 adalah open source yang digunakan untuk melakukan uji penetrasi. Uji penetrasi akan dilakukan menggunakan beberapa metode yang nantinya studi ini akan memeberikan edukasi kepada setiap orang agar lebih berhati-hati dalam mengakses jaringan nirkabel di rumah maupun tempat umum.

---

ABSTRACTWireless or wireless network is one media or data transmission system that uses radio waves as transmission media and is a development of a computer network that previously used the cable as a connector. Wireless utilize air electromagnetic waves as a medium of traffic exchange data. But over the development of security on wireless networks was quite vulnerable, and provide a high enough potential for hackers. Network security has a major impact on the world for its use, all information can be sent and received without the use of cables. Wireless networks provide all the same functions as cable networks in the absence of physical devices. The main purpose of this study is to demonstrate and analyze the types of attack variations that can be encountered when using wireless networks and also how to mitigate them. Wireless networks have many loopholes in its use. In this study will be used software that is Kali Linux 3.0 is open source used to do penetration test. The penetration test will be conducted using several methods that will provide education for everyone to be more careful in accessing wireless networks at home and public places. "

"Machine generated contents note: Chapter 0: Introduction Chapter 1: Introduction to Command Shell Scripting Chapter 2: Introduction to Python Chapter 3: Introduction to Perl Chapter 4: Introduction to Ruby Chapter 5: Introduction to Web Scripting with PHP Chapter 6: Manipulating Windows with PowerShell Chapter 7: Scanner Scripting Chapter 8: Information Gathering Chapter 9: Exploitation Scripting Chapter 10: Post-Exploitation Scripting Appendix: Subnetting and CIDR Addresses"

"The second edition of this comprehensive handbook of computer and information security provides the most complete view of computer security and privacy available. It offers in-depth coverage of security theory, technology, and practice as they relate to established technologies as well as recent advances. It explores practical solutions to many security issues. Individual chapters are authored by leading experts in the field and address the immediate and long-term challenges in the authors’ respective areas of expertise.The book is organized into 10 parts comprised of 70 contributed chapters by leading experts in the areas of networking and systems security, information management, cyber warfare and security, encryption technology, privacy, data storage, physical security, and a host of advanced security topics. New to this edition are chapters on intrusion detection, securing the cloud, securing web apps, ethical hacking, cyber forensics, physical security, disaster recovery, cyber attack deterrence, and more."

"Professional penetration testing walks you through the entire process of setting up and running a pen test lab. Penetration testing—the act of testing a computer network to find security vulnerabilities before they are maliciously exploited—is a crucial component of information security in any organization. With this book, you will find out how to turn hacking skills into a professional career. Chapters cover planning, metrics, and methodologies; the details of running a pen test, including identifying and verifying vulnerabilities; and archiving, reporting and management practices.Author Thomas Wilhelm has delivered penetration testing training to countless security professionals, and now through the pages of this book you can benefit from his years of experience as a professional penetration tester and educator. After reading this book, you will be able to create a personal penetration test lab that can deal with real-world vulnerability scenarios."