1 / 9

Kemanan Web

Kemanan Web. Keamanan Web. How Web Works ? Menggunakan protokol HTTP Klien meminta dokumen melalui URL (Request) Server membalas dengan memberikan dokumen jika ada (Replay) HTTP bersifat Stateless Elemen web lainya : HTML, ASP, PHP, JSP, dll Aplikasi : Audio/Video, Postscript, pdf

elgin
Download Presentation

Kemanan Web

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Kemanan Web

  2. Keamanan Web • How Web Works ? • Menggunakan protokol HTTP • Klien meminta dokumen melalui URL (Request) • Server membalas dengan memberikan dokumen jika ada (Replay) • HTTP bersifat Stateless • Elemen web lainya : • HTML, ASP, PHP, JSP, dll • Aplikasi : Audio/Video, Postscript, pdf • Browser : • Untuk menampilkan doukumen dan gambar • Untuk membantu menjalakan aplikasi • IE, Mozilla, Netscape, Konqueror, Lynx, dll

  3. Web Vulnerabilities • http://www.w3.org/Security/Faq • Intercept informasi dari klien • Data, password, dll • Pencurian data di server • Data, password, dll • Menjalankan aplikasi di server • Memungkinkan melakukan eksekusi program “ngak benar” di server • Denial Of Services • Server Side Scripting, Cgi-Bin • Kesalahan pemograman membuka peluang

  4. Kemanan Web • Authentikasi • FORM HTML • Basic, Digest • Klien Side + Server Side Scripting • Manajemen Sesi • Menggunakan Layer lain • S-HTTP ( discontinoued) • HTTPS ( HTTP ovel SSL) • IPSec • Konfigurasi Web Server • Hak Akses • Indexes • Penempatan File

  5. Authentikasi • FORM HTML • <form action="modules.php?name=Your_Account" method="post">... • <br><input type="hidden" name="op" value="login"> ... • </form> • Tidak di enkripsi • BASIC • Algortima Base64 • Mudah di Dekrip • DIGEST • Alghoritma Digest Ex: MD5 • Belum 100% di support • CS + SS Script • Belum 100% di support • http://toast.newcastle.edu.au/js/md5/browsertest.php3.

  6. Manajemen Sesi • Hiden Form Field • <input type="hidden" name="uniqueticket" • View page Source • Cookies • User harus mennghidupkan fasilitas • Poisoned cookies • Session Id • -rw------- 1 nobody nobody 180 Jun 30 18:46 sess_5cbdcb16f ... • Dapat menggunakan History jika umur sesi belum habis • URL Rewriting • http://login.yahoo.com/config/login?.tries=&.src=ym&.last=&promo=&.intl=us

  7. Konfigurasi Web Server • Hak Akses • Linux / Unix : Web Server => user = apache • Penempatan file • Penempatan file-file penting • <? php include ("./db.inc");?> • <? php include ("./config.php");?> • Backup file konfigurasi • Indexes • Listing Isi Direktori

  8. SSL • Untuk Semua Protokol TCP • Telnet -> SSH • HTTP -> HTTPS • Public Key Server • Hashing • MD5 + SHA • CA • Sekarang -> TLS

More Related