Belajar Security Tester - Compliance Testing

ASVS V2 - Authentication:
├── V2.1.1: Password security requirements
│   └── Test: password policy validation
├── V2.2.1: General authenticator requirements
│   └── Test: brute force protection
└── V2.3.1: Authentication session management
    └── Test: session timeout, fixation
 
ASVS V3 - Session Management:
├── V3.1.1: Session binding
│   └── Test: session token quality
├── V3.2.1: Session timeout
│   └── Test: idle timeout, absolute timeout
└── V3.3.1: Session termination
    └── Test: logout invalidates session

PCI DSS Requirement:
├── Req 1: Install and maintain network security controls
│   └── Test: firewall rules, network segmentation
├── Req 2: Apply secure configurations
│   └── Test: default credentials, unnecessary services
├── Req 3: Protect stored account data
│   └── Test: encryption at rest, tokenization
├── Req 4: Protect cardholder data with strong cryptography
│   └── Test: TLS 1.2+, strong ciphers
├── Req 6: Develop and maintain secure systems
│   └── Test: SAST, DAST, patch management
├── Req 8: Identify users and authenticate access
│   └── Test: MFA, password policy
├── Req 10: Log and monitor all access
│   └── Test: audit logs, monitoring
└── Req 11: Test security regularly
    └── Test: vulnerability scans, penetration testing

GDPR Article 32 - Security of Processing:
├── Pseudonymisation and encryption of personal data
│   └── Test: data encryption, anonymization
├── Confidentiality, integrity, availability
│   └── Test: access controls, backup, recovery
├── Ability to restore availability and access
│   └── Test: disaster recovery, backup restoration
└── Regular testing and evaluation
    └── Test: vulnerability scanning, penetration testing

# 1. Authentication testing
curl -X POST http://localhost:3000/api/login \
  -d '{"email":"test@test.com","password":"123"}'  # Weak password
 
# 2. Session management
curl -v http://localhost:3000/api/user 2>&1 | grep -i "set-cookie"
 
# 3. Encryption
nmap --script ssl-enum-ciphers -p 443 localhost
 
# 4. Logging
curl http://localhost:3000/api/unauthorized  # Cek apakah logged
 
# 5. Error handling
curl http://localhost:3000/api/error  # Cek verbose errors

Compliance Report Structure:
├── Framework: PCI DSS v4.0, GDPR, ASVS Level 2
├── Scope: Aplikasi, API, Infrastructure
├── Findings: Per requirement dengan status (Pass/Fail/Partial)
├── Evidence: Screenshots, test results, configuration
├── Gap Analysis: Requirements yang belum terpenuhi
├── Remediation: Langkah untuk mencapai compliance
└── Timeline: Target compliance date

# Test authentication requirements (ASVS V2)
# 1. Password policy
curl -X POST http://localhost:3000/api/register \
  -d '{"email":"test@test.com","password":"123"}'
 
# 2. Brute force protection
for i in $(seq 1 20); do
  curl -s -o /dev/null -X POST http://localhost:3000/api/login \
    -d '{"email":"test@test.com","password":"wrong"}'
done
 
# 3. Session management
curl -v http://localhost:3000/api/login \
  -X POST -d '{"email":"test@test.com","password":"correct"}' 2>&1 | grep "set-cookie"