Belajar Security Tester - Automated Security Testing

#Pendahuluan

Setelah di episode 7 kita menguasai Burp Suite & ZAP, pada episode ini kita beralih ke otomasi — menjadikan security testing bagian dari CI/CD pipeline. Di 2026, manual testing saja tidak cukup; setiap commit harus otomatis di-scan untuk kerentanan.

#SAST di CI/CD

#Semgrep

yaml

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]
jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

#CodeQL

yaml

# CodeQL analysis
- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: javascript
 
- name: Perform CodeQL Analysis
  uses: github/codeql-action/analyze@v3

#DAST di CI/CD

#ZAP Docker Scan

yaml

  zap-scan:
    runs-on: ubuntu-latest
    needs: deploy-staging
    steps:
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: ${{ env.STAGING_URL }}
          rules_file_name: 'zap-rules.tsv'
          cmd: true

#SCA (Software Composition Analysis)

#npm audit

bash

# Scan dependencies
npm audit --audit-level=high
npm audit fix

#Snyk

bash

# Install Snyk
npm install -g snyk
 
# Test dependencies
snyk test
 
# Monitor for new vulnerabilities
snyk monitor

#Trivy (Container Scan)

bash

# Scan container image
trivy image myapp:latest
 
# Scan filesystem
trivy fs --security-checks vuln .

#Security Regression Testing

Regression testing memastikan vulnerability yang sudah diperbaiki tidak muncul kembali:

bash

# Simpan baseline findings
semgrep --config p/owasp-top-ten --json . > baseline.json
 
# Di CI, bandingkan dengan baseline
semgrep --config p/owasp-top-ten --json . > current.json
# Bandingkan dan fail jika ada new findings

Tip

Mulai dengan SAST + SCA (cepat, murah) di setiap pull request, lalu tambah DAST di staging environment untuk scan mendalam.

#Pipeline Security Lengkap

yaml

name: Security Pipeline
on: [push, pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
 
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high
 
  container:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

#Penutup

SAST: Semgrep/CodeQL di setiap pull request — analisis source code.
SCA: npm audit/Snyk/Trivy — scan dependencies untuk vulnerability known.
DAST: ZAP Docker di staging — testing aplikasi yang sudah berjalan.
Regression: bandingkan findings dengan baseline untuk mencegah regression.

Di episode 9 selanjutnya kita akan membahas testing business logic flaws — menemukan abuse cases, race conditions, dan vulnerability yang tidak terdeteksi scanner otomatis. Sampai jumpa di episode 9!