Belajar QA Tester - Security Testing Dasar

#Pendahuluan

Setelah di episode 16 kita mempelajari accessibility testing, pada episode ini kita mempelajari security testing dasar — bagaimana menguji keamanan aplikasi untuk memastikan data pengguna terlindungi. Security testing penting karena breach keamanan bisa merusak reputasi dan menyebabkan kerugian finansial besar.

Mengapa security testing penting? Karena setiap tahun kerugian akibat cybercrime meningkat. QA Tester harus memiliki security awareness untuk menemukan vulnerabilities sebelum attacker menemukannya.

#OWASP Top 10 (2021)

text

OWASP Top 10:
├── A01: Broken Access Control
│   ├── User bisa akses data user lain
│   └── Test: Coba akses resource tanpa authorization
├── A02: Cryptographic Failures
│   ├── Data sensitif tidak terenkripsi
│   └── Test: Cek HTTPS, encryption at rest
├── A03: Injection
│   ├── SQL injection, XSS
│   └── Test: Input malicious strings
├── A04: Insecure Design
│   ├── Missing security controls
│   └── Test: Review design patterns
├── A05: Security Misconfiguration
│   ├── Default credentials, unnecessary services
│   └── Test: Scan configuration
├── A06: Vulnerable Components
│   ├── Outdated libraries
│   └── Test: Check dependency versions
├── A07: Auth Failures
│   ├── Weak passwords, session issues
│   └── Test: Brute force, session hijacking
├── A08: Data Integrity Failures
│   ├── Unsigned updates
│   └── Test: Verify integrity checks
├── A09: Logging Failures
│   ├── Insufficient logging
│   └── Test: Verify logging
└── A10: SSRF
    ├── Server-side request forgery
    └── Test: Inject URLs

#Basic Security Testing

#Input Validation Testing

text

Input Validation Tests:
├── SQL Injection:
│   ├── Input: ' OR '1'='1
│   ├── Expected: Input ditolak
│   └── Risk: Database compromise
├── XSS (Cross-Site Scripting):
│   ├── Input: &lt;script&gt;alert('XSS')&lt;/script&gt;
│   ├── Expected: Script tidak execute
│   └── Risk: Session hijacking
├── Path Traversal:
│   ├── Input: ../../etc/passwd
│   ├── Expected: File tidak bisa diakses
│   └── Risk: Data leakage
└── Command Injection:
    ├── Input: ; ls -la
    ├── Expected: Command tidak execute
    └── Risk: System compromise

#Authentication Testing

text

Authentication Tests:
├── Weak Password:
│   ├── Coba login dengan password: 123456
│   ├── Expected: Password policy enforced
│   └── Risk: Account compromise
├── Brute Force:
│   ├── Coba login 100x dengan password berbeda
│   ├── Expected: Rate limiting aktif
│   └── Risk: Account lockout/breach
├── Session Management:
│   ├── Login → Logout → Coba akses pakai old session
│   ├── Expected: Session invalidated
│   └── Risk: Session hijacking
└── Token Security:
    ├── Inspect JWT token
    ├── Expected: Proper signing, expiry
    └── Risk: Token forgery

Note

QA tester tidak harus menjadi security expert. Tapi dengan memahami OWASP Top 10 dan basic security testing, kalian bisa menemukan vulnerabilities yang paling umum dan melaporkannya ke tim.

#Security Testing Tools

text

Security Testing Tools:
├── OWASP ZAP:
│   ├── Free & open source
│   ├── Automated scanning
│   └── Manual testing proxy
├── Burp Suite:
│   ├── Industry standard
│   ├── Community edition (free)
│   └── Professional features
├── Nmap:
│   ├── Network scanning
│   ├── Port scanning
│   └── Service detection
└── SQLMap:
    ├── SQL injection testing
    ├── Automated exploitation
    └── Database takeover

#Practical: Security Test Checklist

yaml

security_test_checklist:
  authentication:
    - test_weak_passwords
    - test_brute_force
    - test_session_management
    - test_password_reset
  authorization:
    - test_horizontal_privilege
    - test_vertical_privilege
    - test_idor
  input_validation:
    - test_sql_injection
    - test_xss
    - test_path_traversal
    - test_command_injection
  data_protection:
    - test_https_enforcement
    - test_sensitive_data_exposure
    - test_data_encryption
  configuration:
    - test_default_credentials
    - test_error_messages
    - test_security_headers

Tip

Mulai dengan OWASP ZAP untuk automated scanning. Jika menemukan issues, laporkan ke developer dengan severity dan remediation suggestions. Security testing adalah everyone's responsibility.

#Penutup

Pada episode 17 ini, kalian telah mempelajari security testing dasar.

Inti yang harus dibawa pulang:

OWASP Top 10 adalah checklist keamanan wajib.
Basic security testing: input validation, authentication, session management.
Tools: OWASP ZAP (free), Burp Suite (community).
QA Tester harus punya security awareness meskipun bukan security expert.

Di episode 18 selanjutnya, kita akan membahas data privacy in testing — bagaimana menangani data sensitif selama proses testing. Sampai jumpa di episode 18!