Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On
Increasing the use of single sign-on technology by electronic-based service providers in addition to providing benefits also creates vulnerability. Penetration testing needed to identify vulnerabilities and test system security by exploiting those vulnerabilities. This research implements the Penetr...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Universitas Negeri Semarang
2021-06-01
|
| Series: | Edu Komputika Journal |
| Subjects: | |
| Online Access: | https://journal.unnes.ac.id/sju/index.php/edukom/article/view/47179 |
| _version_ | 1797822176694370304 |
|---|---|
| author | Septia Ulfa Sunaringtyas Djodi Surya Prayoga |
| author_facet | Septia Ulfa Sunaringtyas Djodi Surya Prayoga |
| author_sort | Septia Ulfa Sunaringtyas |
| collection | DOAJ |
| description | Increasing the use of single sign-on technology by electronic-based service providers in addition to providing benefits also creates vulnerability. Penetration testing needed to identify vulnerabilities and test system security by exploiting those vulnerabilities. This research implements the Penetration Testing Execution Standard (PTES) for penetration testing of single singn-on services. Seven stages of the penetration test had done and 12 vulnerabilities were identified, consisting of 3 medium vulnerabilities, 6 low vulnerabilities and 3 information vulnerabilities. Six cyberattacks have been carried out to exploit the vulnerability with the result of 3 successful attacks and 3 failed attacks. Based on the results of the vulnerability and exploitation analysis, recommendations are given consist of regular updating and patching efforts, configuration of the CSP header and content-type-option header on the web server and application server, validation of the host header configuration, x-content-type-options header and deactivation. x-forwarded- hosted on every web page, configure 'secure' flag on cookies, add metacharacter filter feature in source code, and limit login attempts. The results of the PTES’s implementation are proven to make it easier for testers to carry out penetration tests and effectively prevent disputes between testers and clients due to differences in the scope of testing. |
| first_indexed | 2024-03-13T10:04:05Z |
| format | Article |
| id | doaj.art-2dbb436c6d804efb8e841b3ad3c602ba |
| institution | Directory Open Access Journal |
| issn | 2252-6811 2599-297X |
| language | English |
| last_indexed | 2024-03-13T10:04:05Z |
| publishDate | 2021-06-01 |
| publisher | Universitas Negeri Semarang |
| record_format | Article |
| series | Edu Komputika Journal |
| spelling | doaj.art-2dbb436c6d804efb8e841b3ad3c602ba2023-05-23T02:47:24ZengUniversitas Negeri SemarangEdu Komputika Journal2252-68112599-297X2021-06-0181485610.15294/edukomputika.v8i1.4717947179Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-OnSeptia Ulfa Sunaringtyas0Djodi Surya Prayoga1Politeknik Siber dan Sandi NegaraPoliteknik Siber dan Sandi NegaraIncreasing the use of single sign-on technology by electronic-based service providers in addition to providing benefits also creates vulnerability. Penetration testing needed to identify vulnerabilities and test system security by exploiting those vulnerabilities. This research implements the Penetration Testing Execution Standard (PTES) for penetration testing of single singn-on services. Seven stages of the penetration test had done and 12 vulnerabilities were identified, consisting of 3 medium vulnerabilities, 6 low vulnerabilities and 3 information vulnerabilities. Six cyberattacks have been carried out to exploit the vulnerability with the result of 3 successful attacks and 3 failed attacks. Based on the results of the vulnerability and exploitation analysis, recommendations are given consist of regular updating and patching efforts, configuration of the CSP header and content-type-option header on the web server and application server, validation of the host header configuration, x-content-type-options header and deactivation. x-forwarded- hosted on every web page, configure 'secure' flag on cookies, add metacharacter filter feature in source code, and limit login attempts. The results of the PTES’s implementation are proven to make it easier for testers to carry out penetration tests and effectively prevent disputes between testers and clients due to differences in the scope of testing.https://journal.unnes.ac.id/sju/index.php/edukom/article/view/47179ptespenetration testingvulnerabilityrisksingle sign oninformation securitycyber attack |
| spellingShingle | Septia Ulfa Sunaringtyas Djodi Surya Prayoga Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On Edu Komputika Journal ptes penetration testing vulnerability risk single sign on information security cyber attack |
| title | Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On |
| title_full | Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On |
| title_fullStr | Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On |
| title_full_unstemmed | Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On |
| title_short | Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On |
| title_sort | implementasi penetration testing execution standard untuk uji penetrasi pada layanan single sign on |
| topic | ptes penetration testing vulnerability risk single sign on information security cyber attack |
| url | https://journal.unnes.ac.id/sju/index.php/edukom/article/view/47179 |
| work_keys_str_mv | AT septiaulfasunaringtyas implementasipenetrationtestingexecutionstandarduntukujipenetrasipadalayanansinglesignon AT djodisuryaprayoga implementasipenetrationtestingexecutionstandarduntukujipenetrasipadalayanansinglesignon |