Pentest-Bukalapak-Marzuki Hasibuan.pdf

12/8/22, 10:28 PM ZAP Scanning Report
file:///G:/PENTEST BUKALAPAK/Report.html 1/420
ZAP Scanning Report
Summary of Alerts
Risk Level Number of Alerts
High 1
Medium 62
Low 147
Informational 52
Alert Detail
High (Medium) Remote OS Command Injection
Description
Attack technique used for unauthorized execution of operating system commands. This attack is
possible when an application accepts untrusted input to build operating system commands in an
insecure manner involving improper data sanitization, and/or improper calling of external programs.
URL http://m.bukalapak.com/listrik-pln/token-listrik?from=mweb_homepage%22%3Bsleep+15%3B%22
Method GET
Parameter from
Attack mweb_homepage";sleep 15;"
URL http://m.bukalapak.com/tiket-pesawat?desktop_view=1&from=mweb_homepage%3Bsleep+15%3B
Method GET
Parameter from
Attack mweb_homepage;sleep 15;
URL
http://m.bukalapak.com/kereta-api?
desktop_view=1&from=mweb_homepage%22%3Bsleep+15%3B%22
Method GET
Parameter from
Attack mweb_homepage";sleep 15;"
Instances 3
Solution If at all possible, use library calls rather than external processes to recreate the desired functionality.
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the
process and the operating system. This may effectively restrict which files can be accessed in a
particular directory or which commands can be executed by your software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code
may provide some protection. For example, java.io.FilePermission in the Java SecurityManager
allows you to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of
your application may still be subject to compromise.
For any data that will be used to generate a command to be executed, keep as much of that data out
of external control as possible. For example, in web applications, this may require storing the
command locally in the session's state instead of sending it out to the client in a hidden form field.
Use a vetted library or framework that does not allow this weakness to occur or provides constructs
that make this weakness easier to avoid.

For example, consider using the ESAPI Encoding control or a similar tool, library, or framework.
These will help the programmer encode outputs in a manner less prone to error.
If you need to use dynamically-generated query strings or commands in spite of the risk, properly
quote arguments and escape any special characters within those arguments. The most conservative
approach is to escape or filter all characters that do not pass an extremely strict whitelist (such as
everything that is not alphanumeric or white space). If some special characters are still needed, such
as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of
argument injection.
If the program to be executed allows arguments to be specified within an input file or from standard
input, then consider using that mode to pass arguments instead of the command line.
If available, use structured mechanisms that automatically enforce the separation between data and
code. These mechanisms may be able to provide the relevant quoting, encoding, and validation
automatically, instead of relying on the developer to provide this capability at every point where
output is generated.
Some languages offer multiple functions that can be used to invoke commands. Where possible,
identify any function that invokes a command shell using a single string, and replace it with a function
that requires individual arguments. These functions typically perform appropriate quoting and filtering
of arguments. For example, in C, the system() function accepts a string that contains the entire
command to be executed, whereas execl(), execve(), and others require an array of strings, one for
each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if
system() is provided with an array of arguments, then it will quote each of the arguments.
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a
whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. Do not rely exclusively on
looking for malicious or malformed inputs (i.e., do not rely on a blacklist). However, blacklists can be
useful for detecting potential attacks or determining which inputs are so malformed that they should
be rejected outright.
When performing input validation, consider all potentially relevant properties, including length, type of
input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if you are
expecting colors such as "red" or "blue."
When constructing OS command strings, use stringent whitelists that limit the character set based on
the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but
this technique is less important than proper output encoding and escaping.
Note that proper output encoding, escaping, and quoting is the most effective solution for preventing
OS command injection, although input validation may provide some defense-in-depth. This is
because it effectively limits what will appear in output. Input validation will not always prevent OS
command injection, especially if you are required to support free-form text fields that could contain
arbitrary characters. For example, when invoking a mail program, you might need to allow the subject
field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be
escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS
command injection, but it would produce incorrect behavior because the subject field would not be
recorded as the user intended. This might seem to be a minor inconvenience, but it could be more
important when the program relies on well-structured subject lines in order to pass messages to other
components.
Even if you make a mistake in your validation (such as forgetting one out of 100 input fields),
appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not
done in isolation, input validation is still a useful technique, since it may significantly reduce your
attack surface, allow you to detect some attacks, and provide other security benefits that proper
encoding does not address.
Reference
http://cwe.mitre.org/data/definitions/78.html
https://owasp.org/www-community/attacks/Command_Injection
CWE Id 78
WASC Id 31

Source ID 1
Medium (Medium) Cross-Domain Misconfiguration
Description
Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS)
misconfiguration on the web server
URL https://s0.bukalapak.com/images/cs-bl-map-location.png
Method GET
Evidence Access-Control-Allow-Origin: *
URL https://s0.bukalapak.com/ast/webpack/category_navbar-0321ff6561b5067c6601.js
Method GET
URL https://s0.bukalapak.com/ast/bazaar-dweb/snowflake/bazaar@2.16.0.css
Method GET
URL https://s0.bukalapak.com/ast/bazaar-dweb/base/utils@2.17.0.css
Method GET
URL https://s0.bukalapak.com/ast/webpack/user_sessions/login_stripped-968adbaff204b1b24fb5.js
Method GET
URL https://s0.bukalapak.com/ast/bazaar-dweb/base/bazaar@2.30.1.css
Method GET
URL
https://s0.bukalapak.com/ast/vendor-
bd9fb863fc6337f4c9e8e91d9832fad0d5611cca9a5c428ba6cbc7a743524383.js
Method GET
URL https://s0.bukalapak.com/ast/bazaar-dweb/base/global@0.10.0.css
Method GET
Instances 8
Solution
Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-
listing, for instance).
Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or
remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy
(SOP) in a more restrictive manner.
Other information
The CORS misconfiguration on the web server permits cross-domain read requests from arbitrary
third party domains, using unauthenticated APIs on this domain. Web browser implementations do
not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces
the risk somewhat. This misconfiguration could be used by an attacker to access data that is
available in an unauthenticated manner, but which uses some other form of security, such as IP
address white-listing.
Reference http://www.hpenterprisesecurity.com/vulncat/en/vulncat/vb/html5_overly_permissive_cors_policy.html
CWE Id 264

WASC Id 14
Source ID 3
Medium (Medium) X-Frame-Options Header Not Set
Description
X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking'
attacks.
URL http://s0.bukalapak.com
Method GET
Parameter X-Frame-Options
URL http://s0.bukalapak.com/
Method GET
Instances 2
Solution
Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web
pages returned by your site (if you expect the page to be framed only by pages on your server (e.g.
it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the
page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web
page in supported web browsers).
Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
CWE Id 16
WASC Id 15
Source ID 3
Description
URL http://s0.bukalapak.com/panduan-belanja?category=pembayaran_tab
Method GET
URL http://s0.bukalapak.com/online/
Method GET
Instances 2
Solution
Other information
CWE Id 264
WASC Id 14

Source ID 3
Description
attacks.
URL http://s.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://respiratorycare.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://push.bukalapak.com
Method GET
Instances 1
Solution

CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://pop3.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://pop.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
URL http://panduan.bukalapak.com
Method GET
Instances 1

Solution
Other information
CWE Id 264
WASC Id 14
Source ID 3
Description
attacks.
URL http://em.noreply.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://mx.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL
https://mitra.bukalapak.com/artikel/112482/mengapa-lebih-untung-menabung-emas-digital-daripada-
perhiasan-atau-fisik
Method GET
URL https://mitra.bukalapak.com/artikel/kategori/kisah-mitra
Method GET
URL
https://mitra.bukalapak.com/artikel/109321/sameday-delivery-service-pesan-stok-barang-hari-ini-
sampai-hari-ini
Method GET
URL https://mitra.bukalapak.com/artikel/112406/juwita-juwara-warung-ter-jelita
Method GET
URL https://mitra.bukalapak.com/artikel/112481/serba-serbi-fitur-tabungan-emas
Method GET
URL https://mitra.bukalapak.com/artikel/112495/tabungan-emas-sekarang-bisa-bantu-pelanggan-naik-haji
Method GET
URL
https://mitra.bukalapak.com/artikel/112496/baru-dari-mitra-bukalapak-tabungan-emas-bisa-jamin-
naik-haji
Method GET
URL https://mitra.bukalapak.com/artikel/112598/ini-keuntungan-nabung-emas-di-mitra-bukalapak
Method GET
URL https://mitra.bukalapak.com/artikel/112344/aktivasi-fitur-kirim-uang-raih-bonus-rp5-000
Method GET
URL https://mitra.bukalapak.com/artikel/112523/viral-juwara-video-review-ala-juwara
Method GET
URL
https://mitra.bukalapak.com/artikel/109179/belanja-stok-barang-mudah-dengan-metode-cod-untuk-
kamu-yang-suka-transaksi-tunai
Method GET
URL https://mitra.bukalapak.com/artikel
Method GET

URL https://mitra.bukalapak.com/grosir
Method GET
URL https://mitra.bukalapak.com/artikel/112483/warung-kamu-butuh-modal-mitra-bukalapak-kasih-solusi
Method GET
URL https://mitra.bukalapak.com/artikel/kategori/akademi-mitra
Method GET
URL https://mitra.bukalapak.com/sebar-poster/47
Method GET
URL https://mitra.bukalapak.com/search
Method GET
URL https://mitra.bukalapak.com/paket-data/pricelist
Method GET
URL https://mitra.bukalapak.com/tentang-mitra/faq
Method GET
URL https://mitra.bukalapak.com/pulsa/pricelist
Method GET
Instances 50
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://mitra.bukalapak.com
Method GET
Instances 1

Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://maskedempire.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://mask6.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://mask.bukalapak.com

Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://maschera.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://mail.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL https://m.bukalapak.com/c/komputer/server
Method GET
URL https://m.bukalapak.com/amp/c/mobil-part-dan-aksesoris/interior-mobil
Method GET
URL
https://m.bukalapak.com/p/handphone/aksesoris-handphone/baterai-176/21tpdml-jual-baterai-
polytron-zap-5-4g-450-4g450-pl-6r5c-double-ic-protection-batre-batrei-battery-batrai-baterei-batere-
batrey-handphone-hp-original-power?cf=1&from=list-
product&funnel=omnisearch&keyword=ZAP&pos=5&product_owner=seller_brand&promoted=1&sea
rch_sort_default=true&sort_origin=relevansi&ssa=0
Method GET
URL https://m.bukalapak.com/c/handphone/aksesoris-handphone
Method GET
URL https://m.bukalapak.com/c/handphone/power-bank
Method GET
URL https://m.bukalapak.com/amp/c/perlengkapan-bayi/feeding-nursing
Method GET
URL https://m.bukalapak.com/amp/c/games/counter-strike
Method GET
URL https://m.bukalapak.com/c/fashion-wanita/kaos
Method GET
URL https://m.bukalapak.com/amp/c/elektronik/setrika-steamer
Method GET
URL https://m.bukalapak.com/amp/c/fashion-wanita/bahan-kain
Method GET
URL https://m.bukalapak.com/c/fashion-pria/pakaian-dalam
Method GET
URL https://m.bukalapak.com/c/industrial/peralatan-medis-laboratori
Method GET

URL https://m.bukalapak.com/c/fashion-wanita/dompet
Method GET
URL https://m.bukalapak.com/c/media/video
Method GET
URL
https://m.bukalapak.com/p/handphone/aksesoris-handphone/baterai-176/oep9lk-jual-baterai-logon-
polytron-zap-6note-4g-550?cf=1&from=list-
product&funnel=omnisearch&keyword=ZAP&pos=41&product_owner=normal_seller&promoted=1&s
earch_sort_default=true&sort_origin=relevansi&ssa=1
Method GET
URL
https://m.bukalapak.com/p/handphone/aksesoris-handphone/baterai-176/21tmh1l-jual-baterai-
polytron-zap-6-flaz-4g-503-4g503-pl-8an5-double-ic-protection-batre-batrei-battery-batrai-baterei-
batere-batrey-handphone-hp-original-power?cf=1&from=list-
product&funnel=omnisearch&keyword=ZAP&pos=3&product_owner=seller_brand&promoted=1&sea
rch_sort_default=true&sort_origin=relevansi&ssa=0
Method GET
URL
https://m.bukalapak.com/p/handphone/aksesoris-handphone/baterai-176/frmaqa-jual-baterai-
handphone-polytron-zap-5-4g450-pl-6r5c-original-batu-batre-oem-polytron-zap-5-battery-4g450?
cf=1&from=list-
product&funnel=omnisearch&keyword=ZAP&pos=26&product_owner=normal_seller&promoted=0&s
earch_sort_default=true&sort_origin=relevansi&ssa=1
Method GET
URL https://m.bukalapak.com/amp/c/olahraga/exercise-fitness
Method GET
URL https://m.bukalapak.com/amp/c/mobil-part-dan-aksesoris/mesin-mobil
Method GET
URL https://m.bukalapak.com/amp/c/kamera/memory-card-194
Method GET
Instances 662
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
URL https://m.bukalapak.com/online/
Method GET
URL https://m.bukalapak.com/panduan-belanja
Method GET
URL https://m.bukalapak.com/panduan-belanja?category=pembayaran_tab
Method GET
Instances 3
Solution
Other information
CWE Id 264
WASC Id 14
Source ID 3
Description
attacks.
URL http://m.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL http://llb-cgk-dc3.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://latexmask.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://imap4.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16

WASC Id 15
Source ID 3
Description
attacks.
URL http://imap.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://grosir.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://gosok.bukalapak.com
Method GET
Instances 1
Solution Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web

CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://geoinfection.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://foxmask.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://festivaliklan.bukalapak.com
Method GET

Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://fernsehen.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://faezamaska.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.

URL http://csanalyst.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://coronax.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://74b0722c.connect.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL http://62c2238b.connect.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://57721163.connect.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://3a958cee.connect.bukalapak.com
Method GET
Instances 1
Solution

CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://0d02d953.connect.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL https://careers.bukalapak.com/
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://careers.bukalapak.com
Method GET
Instances 1

CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://c11.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://c0.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://www.bukudbr.bukalapak.com
Method GET

Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL
https://bukapotensi.bukalapak.com/general/inside-bukalapak-how-i-landed-a-product-design-job-at-
18-for-one-of-indonesias-unicorns/
Method GET
URL https://bukapotensi.bukalapak.com/bukamagang/life-as-data-analyst-intern-at-bukalapak/
Method GET
URL https://bukapotensi.bukalapak.com/bukamagang/
Method GET
URL https://bukapotensi.bukalapak.com/?s
Method GET
URL https://bukapotensi.bukalapak.com/updates/
Method GET
URL https://bukapotensi.bukalapak.com/bukariset/
Method GET
URL https://bukapotensi.bukalapak.com/category/general/
Method GET
URL https://bukapotensi.bukalapak.com/bukabeasiswa/
Method GET
URL https://bukapotensi.bukalapak.com/faq/
Method GET

URL https://bukapotensi.bukalapak.com/category/bukamagang/
Method GET
URL https://bukapotensi.bukalapak.com/
Method GET
URL https://bukapotensi.bukalapak.com/bukafigur/
Method GET
URL
https://bukapotensi.bukalapak.com/bukamagang/how-it-feels-to-be-a-backend-engineer-intern-at-
bukalapak/
Method GET
URL https://bukapotensi.bukalapak.com/bukariset/topics/
Method GET
Instances 14
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://bukapotensi.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL http://bukainfo.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL https://bukabantuan.bukalapak.com/
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Medium (Medium) CSP Scanner: Wildcard Directive
Description
The following directives either allow wildcard sources (or ancestors), are not defined, or are overly
broadly defined:
frame-ancestors
URL https://bukabantuan.bukalapak.com/auth
Method GET
Parameter Content-Security-Policy
Evidence default-src 'none'
Instances 1
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the
Content-Security-Policy header.
Reference http://www.w3.org/TR/CSP2/
http://www.w3.org/TR/CSP/

http://caniuse.com/#search=content+security+policy
http://content-security-policy.com/
https://github.com/shapesecurity/salvation
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://bukabantuan.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL https://blog.bukalapak.com/
Method GET
URL https://blog.bukalapak.com/?keyword=ZAP
Method GET
Instances 2
Solution
CWE Id 16
WASC Id 15
Source ID 3

Description
attacks.
URL http://blog.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://blackvirus.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://bkykvrjffnvmofsemfmingxwjasrkiaaqujhovbm.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16

WASC Id 15
Source ID 3
Description
attacks.
URL http://belajar.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://bbm-service.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://agen.bukalapak.com
Method GET
Instances 1

CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://3rd-service-2.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://3rd-service-1.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://33www.bukalapak.com
Method GET

Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://2fwww.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Description
attacks.
URL http://252fwww.bukalapak.com
Method GET
Instances 1
Solution
CWE Id 16
WASC Id 15
Source ID 3
Low (Medium) Cross-Domain JavaScript Source File Inclusion
Description The page includes one or more script files from a third-party domain.
URL https://s0.bukalapak.com/c/tiket-voucher

Method GET
Parameter https://s3.bukalapak.com/ast/webpack/header_dweb-618fc214237381cb87a8.js
Evidence
<script src="https://s3.bukalapak.com/ast/webpack/header_dweb-618fc214237381cb87a8.js">
</script>
URL https://s0.bukalapak.com/404?from=nav_header
Method GET
Parameter
https://s2.bukalapak.com/ast/siburung-
a40773a6820fd3fbd4e41d5badefad442239c0c2cc701292986401ecde82c3b9.js
Evidence
<script src="https://s2.bukalapak.com/ast/siburung-
a40773a6820fd3fbd4e41d5badefad442239c0c2cc701292986401ecde82c3b9.js"></script>
URL https://s0.bukalapak.com/c/sepeda
Method GET
Parameter
https://s3.bukalapak.com/ast/application-
d91eafd44b206fcf486b9c656237217fbf2b0c821210b85b65341fbdefd409e7.js
Evidence
<script src="https://s3.bukalapak.com/ast/application-
d91eafd44b206fcf486b9c656237217fbf2b0c821210b85b65341fbdefd409e7.js" class="js-application-
script"></script>
URL https://s0.bukalapak.com/merk
Method GET
Evidence
</script>
URL https://s0.bukalapak.com/c/fashion-pria
Method GET
Parameter
Evidence
URL https://s0.bukalapak.com/c/perlengkapan-kantor
Method GET
Parameter https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Evidence <script async src='https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js'></script>
URL https://s0.bukalapak.com/manfaat
Method GET
Parameter https://www.googletagservices.com/tag/js/gpt.js
Evidence <script async='' src='https://www.googletagservices.com/tag/js/gpt.js' type='text/javascript'></script>
URL https://s0.bukalapak.com/mobile-apps?from=nav_header
Method GET
Parameter https://s3.bukalapak.com/ast/webpack/grandfleet/fragment_loader-a9128efe32ee9df004af.js
Evidence
<script src="https://s3.bukalapak.com/ast/webpack/grandfleet/fragment_loader-
a9128efe32ee9df004af.js"></script>
URL https://s0.bukalapak.com/404
Method GET

Evidence
URL https://s0.bukalapak.com/c/kamera
Method GET
URL https://s0.bukalapak.com/c/fashion-wanita
Method GET
Parameter
Evidence
script"></script>
URL https://s0.bukalapak.com/c/motor-471
Method GET
Parameter
Evidence
script"></script>
URL https://s0.bukalapak.com/affiliate
Method GET
Evidence
URL https://s0.bukalapak.com/faq
Method GET
URL https://s0.bukalapak.com/c/elektronik
Method GET
Parameter https://s2.bukalapak.com/javascripts/honeybadger-v0.5.min.js
Evidence <script src='https://s2.bukalapak.com/javascripts/honeybadger-v0.5.min.js'></script>
URL https://s0.bukalapak.com/?from=nav_header
Method GET
URL https://s0.bukalapak.com/panduan_keamanan
Method GET
Parameter
https://s4.bukalapak.com/ast/polyfills-
b92e7dd7a44a91ed5d3c23b5e415a932458fde6e5a19b3ae128f4b59500edf13.js
Evidence
<script src="https://s4.bukalapak.com/ast/polyfills-
b92e7dd7a44a91ed5d3c23b5e415a932458fde6e5a19b3ae128f4b59500edf13.js" class="js-polyfills-
script"></script>
URL https://s0.bukalapak.com/c/perawatan-kecantikan

Method GET
URL https://s0.bukalapak.com/manfaat
Method GET
Evidence
URL https://s0.bukalapak.com/bukapengadaan/
Method GET
Parameter
https://static-morpheus.bukalapak.com/assets/custom-
elements/vendor~b916e1a4.311f197e8bdefab20f41.61856d9ba42c54e8d236.min.js
Evidence
<script type="text/javascript" src="https://static-morpheus.bukalapak.com/assets/custom-
elements/vendor~b916e1a4.311f197e8bdefab20f41.61856d9ba42c54e8d236.min.js"></script>
Instances 347
Solution
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be
controlled by end users of the application.
Reference
CWE Id 829
WASC Id 15
Source ID 3
Low (Medium) X-Content-Type-Options Header Missing
Description
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older
versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially
causing the response body to be interpreted and displayed as a content type other than the declared
content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if
one is set), rather than performing MIME-sniffing.
Method GET
Parameter X-Content-Type-Options
URL https://s0.bukalapak.com/ast/webpack/user_sessions/login_stripped-968adbaff204b1b24fb5.js
Method GET
Method GET
URL
Method GET
Method GET

URL https://s0.bukalapak.com/manifest-new-logo.json
Method GET
URL https://s0.bukalapak.com/images/cs-bl-map-location.png
Method GET
Method GET
URL https://s0.bukalapak.com/ast/webpack/category_navbar-0321ff6561b5067c6601.js
Method GET
Instances 9
Solution
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets
the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does
not perform MIME-sniffing at all, or that can be directed by the web application/web server to not
perform MIME-sniffing.
Other information
This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected
by injection issues, in which case there is still concern for browsers sniffing pages away from their
actual content type.
At "High" threshold this scanner will not alert on client or server error responses.
Reference
http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx
https://owasp.org/www-community/Security_Headers
CWE Id 16
WASC Id 15
Source ID 3
Low (Medium) Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description
The web/application server is leaking information via one or more "X-Powered-By" HTTP response
headers. Access to such information may facilitate attackers identifying other
frameworks/components your web application is reliant upon and the vulnerabilities such
components may be subject to.
URL https://s0.bukalapak.com/c?from=nav_header
Method GET
Evidence X-Powered-By: Phusion Passenger 5.3.2
URL https://s0.bukalapak.com/c/olahraga
Method GET
URL https://s0.bukalapak.com/login?from=nav_header
Method GET
URL https://s0.bukalapak.com/c/food

Method GET
URL https://s0.bukalapak.com/c/fashion-pria
Method GET
Method GET
URL https://s0.bukalapak.com/c/mobil-part-dan-aksesoris
Method GET
URL https://s0.bukalapak.com/c/komputer
Method GET
URL https://s0.bukalapak.com/faq
Method GET
URL https://s0.bukalapak.com/c/kamera
Method GET
URL https://s0.bukalapak.com/c/perlengkapan-kantor
Method GET
URL https://s0.bukalapak.com/send_app_link
Method POST
URL https://s0.bukalapak.com/c/hobi-koleksi
Method GET
URL https://s0.bukalapak.com/c/tiket-voucher
Method GET
URL https://s0.bukalapak.com/affiliate
Method GET
URL https://s0.bukalapak.com/c/perawatan-kecantikan
Method GET
Method GET

Evidence X-Powered-By: Express
URL https://s0.bukalapak.com/c/fashion-wanita
Method GET
URL https://s0.bukalapak.com/c/sepeda
Method GET
URL https://s0.bukalapak.com/privacy
Method GET
Instances 38
Solution
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-
Powered-By" headers.
Reference
http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
CWE Id 200
WASC Id 13
Source ID 3
Low (Medium) Cookie Without Secure Flag
Description
A cookie has been set without the secure flag, which means that the cookie can be accessed via
unencrypted connections.
Method GET
Parameter lskjfewjrh34ghj23brjh234
Evidence Set-Cookie: lskjfewjrh34ghj23brjh234
Method GET
Parameter _mkra_ctxt
Evidence Set-Cookie: _mkra_ctxt
Method GET
URL https://s0.bukalapak.com/bl/pulsa?from=nav_header
Method GET
Parameter _stepmother_session
Evidence Set-Cookie: _stepmother_session
Method GET

Method GET
Instances 6
Solution
Whenever a cookie contains sensitive information or is a session token, then it should always be
passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such
sensitive information.
Reference
https://owasp.org/www-project-web-security-testing-guide/v41/4-
Web_Application_Security_Testing/06-Session_Management_Testing/02-
Testing_for_Cookies_Attributes.html
CWE Id 614
WASC Id 13
Source ID 3
Low (Medium) Incomplete or No Cache-control and Pragma HTTP Header Set
Description
The cache-control and pragma HTTP header have not been set properly or are missing allowing the
browser and proxies to cache content.
URL https://s0.bukalapak.com/about
Method GET
Parameter Cache-Control
Method GET
Evidence public, max-age=10368000
URL https://s0.bukalapak.com/manifest-new-logo.json
Method GET
Method GET
Method GET
Method GET
Method GET

Instances 7
Solution
Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-
revalidate; and that the pragma HTTP header is set with no-cache.
Reference
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-
content-caching
CWE Id 525
WASC Id 13
Source ID 3
Low (Medium) Cookie Without SameSite Attribute
Description
A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a
result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site
request forgery, cross-site script inclusion, and timing attacks.
Method GET
Method GET
Method GET
Method GET
Method GET
URL https://s0.bukalapak.com/bl/pulsa?from=nav_header
Method GET
Instances 6
Solution Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.
Reference https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site
CWE Id 16
WASC Id 13

Source ID 3
Low (Medium) Absence of Anti-CSRF Tokens
Description
No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a
target destination without their knowledge or intent in order to perform an action as the victim. The
underlying cause is application functionality using predictable URL/form actions in a repeatable way.
The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast,
cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks
are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF,
XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges,
but recent techniques have been discovered to disclose information by gaining access to the
response. The risk of information disclosure is dramatically increased when the target site is
vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate
within the bounds of the same-origin policy.
URL
Method GET
Evidence <form enctype='multipart/form-data' method='post'>
URL
Method GET
Evidence <form>
URL
Method GET
Evidence <form method="post" action="'+r+'">
Method GET
Evidence <form>
URL
Method GET
Evidence <form>
URL
Method GET
Evidence <form>
Instances 6
Solution Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs
that make this weakness easier to avoid.
For example, use anti-CSRF packages such as the OWASP CSRFGuard.
Phase: Implementation
Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can
be bypassed using attacker-controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon
receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Note that this can be bypassed using XSS.
Identify especially dangerous operations. When the user performs a dangerous operation, send a
separate confirmation request to ensure that the user intended to perform that operation.
Note that this can be bypassed using XSS.
Use the ESAPI Session Management control.
This control includes a component for CSRF.
Do not use the GET method for any request that triggers a state change.
Phase: Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could
break legitimate functionality, because users or proxies may have disabled sending the Referer for
privacy reasons.
Other information
No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken,
csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf,
_csrfSecret] was found in the following HTML form: [Form 4: ].
Reference
http://projects.webappsec.org/Cross-Site-Request-Forgery
http://cwe.mitre.org/data/definitions/352.html
CWE Id 352
WASC Id 9
Source ID 3
Low (Medium) Cross-Domain JavaScript Source File Inclusion
Description The page includes one or more script files from a third-party domain.
URL http://s0.bukalapak.com/users/login_menu
Method GET
Parameter
https://s4.bukalapak.com/ast/alligator-
67ea465cf582f9f2ea9d73492b119999251ac50e0821692d6ab797416dc072ea.js
Evidence
<script src="https://s4.bukalapak.com/ast/alligator-
67ea465cf582f9f2ea9d73492b119999251ac50e0821692d6ab797416dc072ea.js"></script>
URL http://s0.bukalapak.com/mobile-apps?from=nav_header
Method GET
URL http://s0.bukalapak.com/*/admin_link$
Method GET

Parameter
Evidence
URL http://s0.bukalapak.com/merk
Method GET
URL http://s0.bukalapak.com/site_map/users-y
Method GET
Parameter
https://s1.bukalapak.com/ast/sigil/assets/fragments-white-header-dweb-stylesheet-
bb3a14bcffbb6826ea04.js
Evidence
<script src="https://s1.bukalapak.com/ast/sigil/assets/fragments-white-header-dweb-stylesheet-
bb3a14bcffbb6826ea04.js" crossorigin defer></script>
URL http://s0.bukalapak.com/site_map/users-t
Method GET
Parameter https://s2.bukalapak.com/marketplace/app-b03699ba842141ed27b0-m.js
Evidence
<script crossorigin="anonymous" nomodule="" src="https://s2.bukalapak.com/marketplace/app-
b03699ba842141ed27b0-m.js" defer=""></script>
URL http://s0.bukalapak.com/site_map/users-m
Method GET
Parameter https://s2.bukalapak.com/marketplace/vnd-b03699ba842141ed27b0-m.js
Evidence
<script crossorigin="anonymous" src="https://s2.bukalapak.com/marketplace/vnd-
b03699ba842141ed27b0-m.js"></script>
URL http://s0.bukalapak.com/site_map/users-n
Method GET
Evidence
URL http://s0.bukalapak.com/c/perlengkapan-kantor
Method GET
URL http://s0.bukalapak.com/c/perawatan-kecantikan
Method GET
Evidence
</script>
URL http://s0.bukalapak.com/payment/
Method GET
Parameter
Evidence
script"></script>

URL http://s0.bukalapak.com/site_map/users-x
Method GET
Parameter
https://s1.bukalapak.com/ast/sigil/assets/fragments-white-header-dweb-stylesheet-
bb3a14bcffbb6826ea04.js
Evidence
<script src="https://s1.bukalapak.com/ast/sigil/assets/fragments-white-header-dweb-stylesheet-
bb3a14bcffbb6826ea04.js" crossorigin defer></script>
URL http://s0.bukalapak.com/site_map/users-s
Method GET
Evidence
<script crossorigin="anonymous" nomodule="" src="https://s2.bukalapak.com/marketplace/app-
b03699ba842141ed27b0-m.js" defer=""></script>
URL http://s0.bukalapak.com/components/products/related_deal/
Method GET
URL http://s0.bukalapak.com/site_map/users-0
Method GET
Parameter https://s2.bukalapak.com/marketplace/summoner-b03699ba842141ed27b0-m.js
Evidence
<script crossorigin="anonymous" src="https://s2.bukalapak.com/marketplace/summoner-
URL http://s0.bukalapak.com/site_map/users-o
Method GET
Evidence
URL http://s0.bukalapak.com/site_map/users-2
Method GET
Parameter https://s2.bukalapak.com/marketplace/summoner-b03699ba842141ed27b0-m.js
Evidence
<script crossorigin="anonymous" src="https://s2.bukalapak.com/marketplace/summoner-
URL http://s0.bukalapak.com/account_settings/
Method GET
Parameter
Evidence
script"></script>
URL http://s0.bukalapak.com/c/perawatan-kecantikan
Method GET
Parameter
Evidence
script"></script>
URL http://s0.bukalapak.com/about

Method GET
Evidence
<script crossorigin="anonymous" type="module" src="https://s2.bukalapak.com/marketplace/app-
Instances 1220
Solution
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be
controlled by end users of the application.
Reference
CWE Id 829
WASC Id 15
Source ID 3
Low (Medium) Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description
The web/application server is leaking information via one or more "X-Powered-By" HTTP response
headers. Access to such information may facilitate attackers identifying other
frameworks/components your web application is reliant upon and the vulnerabilities such
components may be subject to.
URL http://s0.bukalapak.com/*/one_click_form$
Method GET
URL http://s0.bukalapak.com/c?from=nav_header
Method GET
URL http://s0.bukalapak.com/c/mobil-part-dan-aksesoris
Method GET
URL http://s0.bukalapak.com/recomendations/*/owner_actions
Method GET
URL http://s0.bukalapak.com/users/*/report
Method GET
URL http://s0.bukalapak.com/aman
Method GET
URL http://s0.bukalapak.com/panduan_keamanan
Method GET
URL http://s0.bukalapak.com/*/tiny_link_to_cart$
Method GET
URL http://s0.bukalapak.com/404?from=nav_header
Method GET

URL http://s0.bukalapak.com/system4/
Method GET
URL http://s0.bukalapak.com/users/*/inactivity
Method GET
URL http://s0.bukalapak.com/_fragments/revamp-landing-element/cart
Method GET
URL http://s0.bukalapak.com/users/login_menu
Method GET
URL http://s0.bukalapak.com/robots.txt
Method GET
URL http://s0.bukalapak.com/account_settings/
Method GET
URL http://s0.bukalapak.com/c/tiket-voucher
Method GET
URL http://s0.bukalapak.com/products/gadget-komputer
Method GET
URL http://s0.bukalapak.com/privacy
Method GET
URL http://s0.bukalapak.com/products/*/bookmarker$
Method GET
URL http://s0.bukalapak.com/sitemap.xml
Method GET
Instances 96
Solution
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-
Powered-By" headers.
Reference
http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx
http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
CWE Id 200
WASC Id 13

Source ID 3
Low (Medium) Cookie No HttpOnly Flag
Description
A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by
JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be
transmitted to another site. If this is a session cookie then session hijacking may be possible.
Method GET
Parameter browser_id
Evidence Set-Cookie: browser_id
Method GET
Parameter session_id
Evidence Set-Cookie: session_id
Instances 2
Solution Ensure that the HttpOnly flag is set for all cookies.
Reference https://owasp.org/www-community/HttpOnly
CWE Id 16
WASC Id 13
Source ID 3
Low (Medium) X-Content-Type-Options Header Missing
Description
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older
versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially
causing the response body to be interpreted and displayed as a content type other than the declared
content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if
one is set), rather than performing MIME-sniffing.
URL http://s0.bukalapak.com
Method GET
URL http://s0.bukalapak.com/palaver/
Method GET
URL http://s0.bukalapak.com/manifest-new-logo.json
Method GET
URL http://s0.bukalapak.com/
Method GET
Instances 4
Solution
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets
the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does
not perform MIME-sniffing at all, or that can be directed by the web application/web server to not
perform MIME-sniffing.

Pentest-Bukalapak-Marzuki Hasibuan.pdf

Pentest-Bukalapak-Marzuki Hasibuan.pdf

Recommended

Recommended

More Related Content

Similar to Pentest-Bukalapak-Marzuki Hasibuan.pdf

Similar to Pentest-Bukalapak-Marzuki Hasibuan.pdf (20)

Recently uploaded

Recently uploaded (20)

Pentest-Bukalapak-Marzuki Hasibuan.pdf