Analisis Kerentanan Keamanan Website Ruangcosplay dengan Menggunakan Metode Penetration Testing Berbasis Owasp TOP 10:2021

Abstract

The RuangCosplay website manages user data and transactions, requiring a security system capable of protecting against various cyber threats. However, a comprehensive evaluation of the website's security vulnerability level based on current security standards is not yet available. This study aims to identify and analyze the security vulnerabilities of the Ruang Cosplay website using penetration testing methods based on the OWASP Top 10:2021. Testing refers to the NIST SP 800-115 framework, which includes the planning, discovery, attacking, and reporting stages. Vulnerability identification was carried out through open-source intelligence and scanning using Nmap, OWASP ZAP, Dirsearch, and WhatWaf. The results showed that no vulnerabilities with a high or critical risk level were found, so the website's overall security level is considered good. However, 11 vulnerabilities were identified, consisting of 3 medium-risk vulnerabilities and 8 low-risk vulnerabilities. Medium-risk vulnerabilities include the use of an outdated TLS protocol, the absence of a Content Security Policy header, and the failure to implement the Subresource Integrity attribute in third-party scripts. Low-risk vulnerabilities were dominated by misconfigurations in cookies and security headers. This research recommends updating to TLS 1.2 or TLS 1.3, implementing the HttpOnly and Secure attributes on cookies, and implementing Subresource Integrity to improve website security and reduce the potential for future exploits.