Optimalisasi dalam Penetrasi Testing Keamanan Website Menggunakan Teknik SQL Injection dan XSS

Abstract

SQLI (SQL Injection) and XSS are hacking techniques that are often used by hackers. This technique can find out the contents of the database by inserting a script on the website. This technique can be a threat if a website does not have security that can ward off such attacks. Hackers will look for loopholes using this technique in a login menu, searching, upload menu, input menu and URLs that have parameters ending in numbers, but not all websites that can be attacked use this technique if you don't limit the use of characters. This research was conducted to find out the gaps in a website that can be attacked with SQLI and XSS techniques and help optimize website security to avoid these attacks. Penetration testing will be carried out on a CV car rental website. Merdeka Auto Rental which is located in Padang City. This penetration testing uses SQLI and XSS techniques to find security holes in a website. The result of this test is that on the car rental website there are 12 gaps that are vulnerable to SQLI and XSS attacks, based on the results of these tests, a PHP script function is made that can remove all dangerous special characters. The script function is inserted in the PHP input, process and output files. The use of this script function does not apply to attacks other than SQLI and XSS so that if hackers use attack techniques other than that, this website is vulnerable to these attacks. After the script is inserted in the source code of the website, it can be concluded that the 12 known loopholes in the previous test without using the script function have changed status to not vuln or not vulnerable to SQLI and XSS attacks.

Pengembangan Keamanan Website Menggunakan Teknik Penetration Testing dan DAST (Dynamic Application Security Testing)

“…Injeksi SQL dilakukan dengan memodifikasi perintah SQL di formulir masukan aplikasi, memungkinkan penyerang mengirim sintaks ke basis data aplikasi. [8] Hal ini memungkinkan penyerang untuk melihat data yang tidak perlu mereka lihat, seperti data yang dimiliki oleh pengguna lain atau data lain yang dapat diakses oleh aplikasi itu sendiri. Dalam beberapa kasus, pelaku dapat mengubah atau menghapus data dan melakukan perubahan pada konten atau aplikasi.…”

“…Penetration test akan menggunakan url https://db.essajaka.web.id/app/tampilprofil?id=1, ketika mencoba menambahkan karakter (') setelah angka 1, querynya memberikan kesalahan dan ditampilkan di browser. [8] Jika kesalahan seperti itu terjadi, itu tidak akan ditampilkan kepada pengguna. Ini karena ketika terjadi kesalahan dalam query basis data dan ditampilkan di browser, pengguna akan dapat melihat salah satu nama tabel.…”

“…Contohnya : https://db.essajaka.web.id/app/tampilprofil?id=1%27 +and+0+/*!12345union*/+select+1,2,3,4,make_set( 6,@:=0x0a,(select(1)from(information_schema./**/c olumns)where@:=make_set(511,@,0x3c6c693e,0x 5b20,table_schema,0x205d2d2d3e20,table_name,0x3 a3a,column_name)),@), 6,7,8,9,10,11,12…”

Analysis and Implementation of the ISSAF Framework on OSSTMM on Website Security Vulnerabilities Testing in Polinema

“…Therefore, according to [1], [6], and [7] penetration testing is very necessary to be able to find out the security holes that exist in a system in order to improve a system, including the website system. Penetration testing itself is an activity to evaluate the security of a system.…”

“…Research conducted by [8] uses the ISSAF framework to analyze website security, according to him, the ISSAF framework is suitable for doing penetration testing on websites because there are structured guidelines so that testing gets complete and clear directions. While the research conducted by [6] and [9] used the OSSTMM framework as a penetration testing method. The OSSTMM framework is considered better and more thorough in penetration testing because it is comprehensive globally because it does work on the front-end.…”