Belajar Penetration Tester - Security Tools Mastery

#Pendahuluan

Setelah di episode 19 kita mempelajari evasion & detection bypass — menghindari AV/EDR dan OPSEC discipline — pada episode ini kita fokus pada tools: memahami tool mana yang cocok untuk situasi mana, dan bagaimana mengkombinasikannya menjadi workflow yang efisien.

Tool yang tepat di tangan yang tepat menghasilkan produktivitas luar biasa. Tetapi menggunakan tool tanpa pemahaman hanya menghasilkan noise. Episode ini bukan tentang "bagaimana install" — sudah dibahas di episode sebelumnya — melainkan tentang "bagaimana mengoptimalkan penggunaan."

#Burp Suite — Web Testing Platform

#Fitur Utama

Fitur	Kegunaan
Proxy	Intercept & modify HTTP requests
Repeater	Manual request manipulation
Intruder	Automated fuzzing & brute force
Scanner	Automated vulnerability detection
Sequencer	Session token randomness analysis
Decoder	Encoding/decoding (Base64, URL, etc.)

#Workflow Burp Suite

text

Burp Workflow
==============
1. Proxy → set browser proxy → intercept traffic
2. Target →sitemap → enumerate endpoints
3. Intruder → fuzz parameters → find injection
4. Repeater → manual testing → confirm vulnerability
5. Scanner → automated scan → comprehensive coverage
6. Decoder → analyze encoded data
7. Report → export findings

#Extensions Penting

Extension	Kegunaan
Autorize	Authorization testing (BOLA)
Logger++	Advanced logging
Turbo Intruder	High-speed fuzzing
JWT Editor	JWT manipulation
Collaborator Everywhere	OOB testing
Retire.js	Vulnerable JS library detection

#Nuclei — Automated Scanner

Nuclei menggunakan templates untuk scanning kerentanan secara massal:

bash

# Install nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
 
# Basic scan
nuclei -u http://target.com
 
# Scan dengan templates spesifik
nuclei -u http://target.com -t cves/
 
# Scan multiple targets
nuclei -l urls.txt -t technologies/ -severity critical,high
 
# Output ke file
nuclei -u http://target.com -o results.txt -json

#Custom Template

yaml

id: custom-sqli-check
 
info:
  name: Custom SQLi Detection
  severity: high
  tags: sqli
 
requests:
  - method: GET
    path:
      - "{{BaseURL}}/?id=1'%20OR%20'1'='1"
 
    matchers:
      - type: word
        words:
          - "mysql"
          - "syntax"
          - "error"

#Nessus — Vulnerability Assessment

#Workflow

text

Nessus Workflow
================
1. New Scan → Choose template (Basic Network Scan, Web App Test)
2. Add targets (IP/hostname)
3. Configure credentials (authenticated scan)
4. Launch → Wait
5. Review results → Sort by severity
6. Export → PDF/CSV

#Nessus vs Nuclei vs Nmap

Tool	Fokus	Strength	Weakness
Nessus	Vulnerability assessment	Comprehensive, compliance	Slow, commercial
Nuclei	Template-based scanning	Fast, customizable, free	Requires templates
Nmap	Network scanning	Network discovery, fast	Limited vuln coverage

#Automation Pipeline

#Recon Automation

bash

#!/bin/bash
# recon.sh — automated recon pipeline
 
TARGET=$1
 
# Subdomain enumeration
subfinder -d $TARGET -o subs.txt
 
# Probe alive hosts
httpx -l subs.txt -o alive.txt
 
# Port scan
nmap -iL alive.txt -sV -sC -oA scan
 
# Vulnerability scan
nuclei -l alive.txt -severity critical,high -o vulns.txt
 
echo "[+] Recon complete. Check results in ./output/"

#Report Generation

python

# report.py — generate HTML report from nuclei output
import json
 
with open('vulns.json') as f:
    vulns = [json.loads(line) for line in f]
 
# Group by severity
critical = [v for v in vulns if v['info']['severity'] == 'critical']
high = [v for v in vulns if v['info']['severity'] == 'high']
 
# Generate HTML
html = f"""
<h1>Vulnerability Report</h1>
<h2>Critical ({len(critical)})</h2>
<ul>{''.join(f'<li>{v["info"]["name"]}</li>' for v in critical)}</ul>
<h2>High ({len(high)})</h2>
<ul>{''.join(f'<li>{v["info"]["name"]}</li>' for v in high)}</ul>
"""
 
with open('report.html', 'w') as f:
    f.write(html)

Tip

Jangan mengandalkan satu tool saja. Kombinasikan Nmap (network), Nuclei (vulnerability), Burp Suite (web), dan Nessus (comprehensive) untuk coverage maksimal. Setiap tool punya blind spot yang bisa ditutup oleh tool lain.

#Toolchain Lengkap

Fase	Tool
Recon	subfinder, httpx, amass, theHarvester
Scanning	Nmap, Masscan
Web Testing	Burp Suite, ZAP, ffuf, Gobuster
Vulnerability	Nuclei, Nessus, OpenVAS
Exploitation	Metasploit, searchsploit, custom scripts
Password	Hydra, Hashcat, John the Ripper
Reporting	Dradis, PlexTrac, custom scripts

#Praktik: Build Pipeline

Buat automation script yang menggabungkan minimal 3 tools:

Reconnaissance (subfinder + httpx)
Scanning (Nmap + Nuclei)
Report generation (JSON → HTML)

Jalankan terhadap target lab danukur waktu yang dihemat dibanding manual.

#Penutup

Inti yang harus dibawa pulang:

Burp Suite: web testing platform lengkap (proxy, repeater, intruder, scanner).
Nuclei: template-based scanning, cepat, customizable, open-source.
Nessus: vulnerability assessment komprehensif, compliance-ready.
Automation: pipeline recon → scan → report menghemat waktu signifikan.

Di episode 21 selanjutnya, kita akan mempelajari advanced exploitation — chained exploits, custom payloads, dan zero-day mindset untuk serangan yang lebih sophisticated.