Security Analysis of Audit Tools

BRIN has built an Electronic-Based Government System (EBS) application and infrastructure audit tool called Application Audit Tools by the mandate of Presidential Regulation No. 95/2018. However, it is necessary to ensure that the web-based audit tool that has been built is guaranteed security. This research was conducted to measure the vulnerability of the audit tool with a blackbox testing method that utilizes the Burpsuite and The Open Worldwide Application Security Project Zed Attack Proxy (OWASP ZAP) applications. The results obtained state that the audit tool has vulnerabilities. Although the results are still at a medium level such as Content Security Policy, Cross Domain Misconfiguration, and Vulnerability JS library by OWASP ZAP and TLS cookies without secure flag set, all of them need attention to improve system security. Recommendations are also given focusing on improving Content Security Policy, Cross Domain Misconfiguration, patches on javascript components such as jQuery, and handling Cookies and Cache.