Belajar Security Tester - Tools: Burp Suite & ZAP

#Pendahuluan

Setelah di episode 6 kita memahami API security testing, pada episode ini kita mendalami dua tools utama security tester: Burp Suite dan OWASP ZAP. Keduanya adalah intercepting proxy yang memungkinkan kalian melihat, memanipulasi, dan menganalisis traffic HTTP/HTTPS.

#Burp Suite

#Setup Proxy

bash

# Burp Suite Community berjalan di port 8080
# Set browser proxy: 127.0.0.1:8080
# Install Burp CA certificate untuk HTTPS

#Fitur Utama

Fitur	Fungsi
Proxy	Intercept & modify HTTP requests
Repeater	Replay & manipulasi request manual
Intruder	Automated attack (brute force, fuzzing)
Decoder	Encode/decode (base64, URL, HTML)
Comparer	Bandingkan dua response
Scanner	Automated vulnerability scan (Pro)

#Workflow Repeater

text

1. Browse aplikasi dengan proxy aktif
2. Cari request menarik di Proxy > HTTP History
3. Send to Repeater (Ctrl+R)
4. Manipulasi request di Repeater
5. Analyze response
6. Ulangi dengan payload berbeda

#OWASP ZAP

#Setup

bash

# Jalankan ZAP
zaproxy
 
# Atau Docker
docker run -u zap -p 8080:8080 -p 8090:8090 \
  -v $(pwd)/reports:/zap/wrk/:rw \
  ghcr.io/zaproxy/zaproxy:stable zap.sh \
  -daemon -host 0.0.0.0 -port 8080

#Fitur Utama

Fitur	Fungsi
Traditional Scan	Automated crawling & testing
Baseline Scan	Quick passive scan
Full Scan	Deep active scan
API Scan	OpenAPI/GraphQL specific scan
Active Scan	Manual targeted scan

#ZAP Automation Framework

yaml

# zap-config.yaml
env:
  contexts:
    - name: "juice-shop"
      urls:
        - "http://localhost:3000"
      includePaths:
        - "http://localhost:3000.*"
jobs:
  - type: spider
    parameters:
      context: "juice-shop"
      url: "http://localhost:3000"
  - type: activeScan
    parameters:
      context: "juice-shop"

Note

Burp Suite Pro lebih kuat untuk manual testing; ZAP lebih baik untuk automated scanning di CI/CD. Gunakan keduanya sesuai kebutuhan.

#Perbandingan

Aspek	Burp Suite	ZAP
Harga	Community (gratis) / Pro ($449/tahun)	Gratis & open-source
Manual testing	Sangat kuat (Repeater, Intruder)	Bagus (Request/Response viewer)
Automated scan	Pro only	Built-in
Extensions	Banyak (BApp Store)	Banyak (ZAP Marketplace)
CI/CD integration	Baik (Burp REST API)	Sangat baik (ZAP Docker)

#Praktik: Scan Juice Shop

bash

# ZAP baseline scan
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t http://localhost:3000 -r juice-shop-report.html
 
# ZAP full scan (lebih lambat, lebih dalam)
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t http://localhost:3000 -r juice-shop-full.html

#Penutup

Burp Suite: terbaik untuk manual testing — Proxy, Repeater, Intruder.
ZAP: terbaik untuk automated scanning — Baseline, Full, API Scan.
Workflow: intercept → analisis → manipulasi → exploit.
CI/CD: ZAP Docker untuk automated security scan di pipeline.

Di episode 8 selanjutnya kita akan membahas automated security testing — mengotomasi DAST/SAST di CI/CD dan regression security testing. Sampai jumpa di episode 8!