Pengujian Keamanan Website Manajemen Perpustakaan SmartLib Menggunakan Framework OWASP WSTG V 4.2

Abstract

The threat to web-based information system security is a serious issue that is frequently overlooked in Indonesia, reflected in the significant decline of Indonesia's National Cyber Security Index ranking, from 48th place in 2023 to 91st out of 150 countries. SmartLib, as a web-based library management system handling user data, book collections, and borrowing activities, is susceptible to data breaches and misuse in the absence of adequate security mechanisms, yet it had never been tested using OWASP WSTG v4.2. This study aims to analyze the security level and identify vulnerabilities in the SmartLib website, as well as provide remediation recommendations based on the testing results. This is a quantitative study in which security data was obtained through gray-box testing, combining passive testing using OWASP Zed Attack Proxy (ZAP) and active testing based on 13 sub-indicators of Client-Side Testing (WSTG-CLNT) from the OWASP Web Security Testing Guide (WSTG) v4.2 framework. Passive testing identified 19 alerts distributed across high, medium, low, and informational risk levels. In active testing, of the 13 WSTG-CLNT sub-indicators examined, three were declared issues: DOM-Based Cross-Site Scripting (WSTG-CLNT-01), Client-Side URL Redirect (WSTG-CLNT-04), and Clickjacking (WSTG-CLNT-09); seven were declared pass; and three were declared not applicable. This study concludes that the SmartLib website still contains client-side vulnerabilities that could be exploited for session cookie theft, redirection to malicious sites, and interface manipulation via iframe. Recommended remediations include the implementation of output encoding, server-side destination URL validation, and the addition of X-FrameOptions and Content-Security-Policy headers.