Analisis Keamanan Aplikasi Web Menggunakan Penetration Testing Berdasarkan Standar OWASP Pada DVWA

Abstract

Web-based applications currently serve as the vital infrastructure for public and private services. However, this widespread adoption is often not matched by adequate security standards, creating a digital ecosystem vulnerable to exploitation by malicious actors. This study aims to analyze the exploitation mechanisms of critical web application vulnerabilities and formulate effective mitigation strategies to prevent cyber attacks. The research utilizes the Damn Vulnerable Web App (DVWA) simulated in a local server environment using a Black Box Testing approach. This study adopts the Penetration Testing Execution Standard (PTES), which includes information gathering, vulnerability scanning, exploitation, and reporting stages. The testing focuses on two of the most critical attack vectors according to the OWASP Top 10 standard: SQL Injection and Stored Cross-Site Scripting (XSS). The results indicate that at the 'Low Security' level, the application is highly susceptible to injection attacks. SQL Injection attacks successfully exposed all user data within the database, threatening confidentiality, while Stored XSS attacks succeeded in permanently embedding malicious scripts that could attack other users from the client-side. This study concludes that application security must be strengthened from the source code level (secure coding), rather than relying solely on network infrastructure. Recommended mitigation solutions include the implementation of Prepared Statements to prevent query manipulation and Input Sanitization using the htmlspecialchars function to prevent foreign script execution.