Analisis Kerentanan Menggunakan Dynamic Application Security Testing (DAST) Berdasarkan Pedoman OWASP Pada Situs Website Eprints Universitas Muhammadiyah Malang

Muhammad Zakiy Alfaris

Abstract


Keamanan sistem informasi sangat penting dalam pengelolaan data digital, terutama pada website repositori seperti Eprints UMM. Penelitian ini bertujuan mengidentifikasi kerentanan keamanan pada Eprints UMM dalam aspek Data Validation Testing dan Error Handling menggunakan alat uji Zed Attack Proxy (ZAP) dan Arachni. Hasil pengujian menunjukkan kelemahan dalam validasi input yang berisiko terhadap serangan SQL Injection dan Cross-Site Scripting (XSS), serta penanganan pesan error yang dapat mengungkap informasi sensitif. Untuk meningkatkan keamanan, disarankan pengelola Eprints UMM memperbaiki validasi input, mengamankan mekanisme penanganan kesalahan, serta rutin memperbarui perangkat lunak dan perangkat keras. Dengan langkah ini, risiko serangan siber dapat diminimalkan, dan keandalan sistem dapat meningkat.


Keywords


OWASP; Metode DAST; ZAP; Arachni, Mitigasi

Full Text:

PDF

References


G. Nur Pramudyo, Z. Sintia Putri, I. Alim Prayogi, A. Mukti Sari, S. Widianah, and Y. Trisnawati, “Penerapan EPrint sebagai repositori institusi pada Perpustakaan Universitas Muhammadiyah Malang,” Khizanah al-Hikmah : Jurnal Ilmu Perpustakaan, Informasi, dan Kearsipan, vol. 6, no. 1, pp. 12–19, 2018, doi: 10.24252/kah.v6i1a2.

S. S.Kom, M.Kom, W. bayu Ahadin, and Z. ST, MT, “Visualisasi data attacker activity log portable modern honey network,” Jurnal Repositor, vol. 4, no. 1, pp. 95–102, 2022, doi: 10.22219/repositor.v4i1.1446.

I. A. Romadhan, S. Syaifudin, and D. R. Akbi, “Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack,” Jurnal Repositor, vol. 2, no. 4, pp. 475–484, 2020, doi: 10.22219/repositor.v2i4.114.

J. M. Akbar, “Penetration testing Website PT. Sekarlaut Tbk menggunakan Open Web Application Security Project (OWASP) standart top 10,” 2024. [Online]. Available: https://eprints.umm.ac.id/id/eprint/7794/2/Bab

G. W. Wahidin, S. Syaifuddin, and Z. Sari, “Analisis Ransomware Wannacry Menggunakan Aplikasi Cuckoo Sandbox,” Jurnal Repositor, vol. 4, no. 1, pp. 83–94, 2022, doi: 10.22219/repositor.v4i1.1373.

Y. Pan, “Interactive application security testing,” in Proceedings - 2019 International Conference on Smart Grid and Electrical Automation, ICSGEA 2019, 2019, pp. 558–561. doi: 10.1109/ICSGEA.2019.00131.

F. M. Tudela, J. R. B. Higuera, J. B. Higuera, J. A. S. Montalvo, and M. I. Argyros, “On combining static, dynamic and interactive analysis security testing tools to improve OWASP top ten security vulnerability detection in web applications,” Applied Sciences (Switzerland), vol. 10, no. 24, pp. 1–26, 2020, doi: 10.3390/app10249119.

H. Setiawan, L. E. Erlangga, and I. Baskoro, “Vulnerability analysis using the Interactive Application Security Testing (IAST) approach for government x website applications,” in 2020 3rd International Conference on Information and Communications Technology, ICOIACT 2020, 2020, pp. 471–475. doi: 10.1109/ICOIACT50329.2020.9332116.

Y. Ardiansah, “Analisis vulnerability Sistem Manajemen Tugas Akhir (Simanta) Universitas Muhammadiyah Malang,” 2024. [Online]. Available: https://eprints.umm.ac.id/id/eprint/12991/2/BAB

H. I. Perdhana, “Analisis dan mitigasi celah keamanan Website SIMPKN Informatika menggunakan Metode OWASP Zed Attack Proxy (ZAP),” 2024. [Online]. Available: https://eprints.umm.ac.id/id/eprint/5627/2/BAB

S. Margareth and others, “Uji Penetration Testing Web Server XYZ, menggunakan Metode OWASP TOP 10 dan CVSS,” 2024. [Online]. Available: https://conferences.ittelkom-pwt.ac.id/index.php/centive/article/view/400/321

F. Noeraini, “Evaluasi Keamanan Website Dinas AB di Jawa Timur Terhadap Temuan dan Solusi Kerentanan,” Galang Tanjung, pp. 1–9, 2023.

Sunardi, I. Riadi, and P. A. Raharja, “Vulnerability analysis of E-voting application using open web application security project (OWASP) framework,” International Journal of Advanced Computer Science and Applications, vol. 10, no. 11, pp. 135–143, 2019, doi: 10.14569/IJACSA.2019.0101118.

R. Vibhandik and A. K. Bose, “Vulnerability assessment of web applications-a testing approach,” in 2015 4th International Conference on e-Technologies and Networks for Development, ICeND 2015, 2015, pp. 16–21. doi: 10.1109/ICeND.2015.7328531.

J. Shahid, M. K. Hameed, I. T. Javed, K. N. Qureshi, M. Ali, and N. Crespi, “A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions,” Applied Sciences (Switzerland), vol. 12, no. 8, 2022, doi: 10.3390/app12084077.

S. Andriyani, M. F. Sidiq, and B. P. Zen, “Analisis celah keamanan pada website dengan menggunakan metode penetration testing dan framework issaf pada Website SMK Al-Kautsar,” Journal Informatic and Information Technology, vol. 8798, pp. 1–13, 2023.

A. Alkatiri, “Analisis celah Keamanan dan monitoring website menggunakan OWASP Zed Attack Proxy (ZAP) & WAZUH (Studi Kasus: Website Dukcapil Kab. Nganjuk),” 2024. [Online]. Available: https://eprints.umm.ac.id/id/eprint/13016/49/BAB

OWASP, “Testing guide 4.0,” 2014. [Online]. Available: http://www.owasp.org

Fauzan Rivaldo Sukardi, “Evaluasi keamanan manajemen persuratan berbasis website menggunakan framework OWASP Web Security Testing Guide (WSTG),” 2024. [Online]. Available: https://repository.uinjkt.ac.id/dspace/handle/123456789/76429

Owasp, “OWASP risk rating methodology,” 2013. [Online]. Available: https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology




DOI: https://doi.org/10.17509/jatikom.v7i2.80882

Refbacks

  • There are currently no refbacks.


Copyright (c) 2025 Universitas Pendidikan Indonesia (UPI)

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

JATIKOM is published by Universitas Pendidikan Indonesia
Jl. Dr. Setiabudhi 229 Bandung 40154, West Java, Indonesia
Website: http://www.upi.edu