Penetration Testing White-Box dan Black-Box pada Web Server Menggunakan Large Language Model

Bayani Adam Sasaki; I Putu Hariyadi; Lilik Widyawati

doi:10.31004/riggs.v5i2.11841

Authors

Bayani Adam Sasaki Universitas Bumigora
I Putu Hariyadi Universitas Bumigora
Lilik Widyawati Universitas Bumigora

DOI:

https://doi.org/10.31004/riggs.v5i2.11841

Keywords:

LLM Lokal, PTES, Web Server, Penetration Testing

Abstract

Audit keamanan dan pengujian penetrasi (penetration testing) secara manual pada web server membutuhkan sumber daya yang besar, waktu yang lama, dan sangat bergantung pada keahlian individu sehingga berisiko menimbulkan temuan yang tidak konsisten. Di sisi lain, penggunaan Large Language Models (LLM) berbasis cloud untuk otomatisasi triage keamanan membuka risiko kebocoran data sensitif berupa konfigurasi sistem dan log kerentanan ke jaringan publik. Penelitian ini mengusulkan dan mengevaluasi kerangka kerja triage keamanan otomatis yang berjalan secara luring (offline) dan dipetakan ke standar Penetration Testing Execution Standard (PTES) menggunakan model lokal Qwen2:1.5b melalui framework Ollama. Alat berbasis Python yang dikembangkan, NULL Security System, memiliki 29 modul untuk audit internal (white-box) dan analisis lalu lintas aktif (black-box). Dalam lingkungan jaringan terisolasi VirtualBox, Kali Linux bertindak sebagai penyerang (menjalankan Nmap, Nuclei, dan FFUF) dan Ubuntu Server 24.04.4 LTS sebagai target. Hasil pengujian selama lima iterasi menunjukkan triage berbantuan LLM lokal mencapai konsistensi 100% dalam penilaian risiko dan ekstraksi Source IP. Rata-rata waktu pemrosesan (Time-to-Insight) tercatat 56 detik untuk triage white-box dan 1 menit 57 detik untuk triage black-box, merepresentasikan peningkatan efisiensi 5 hingga 10 kali lipat dibanding baseline manual. Sistem berhasil mengidentifikasi lalu lintas Nuclei secara konsisten melalui pemetaan pola perilaku URL (behavioral URL pattern) ketika metode pencocokan User-Agent tradisional gagal. Integrasi pemantau proses aktif (psutil) mencegah kelelahan CPU target dengan memicu analisis cadangan (fallback) berbasis kata kunci saat batas load average terlampaui, sehingga menjamin kelayakan sistem lokal dan kedaulatan data.

Downloads

Download data is not yet available.

References

[1] Yosua Ade Pohan, Yuhandri Yunus, and Sumijan, “Meningkatkan Keamanan Webserver Aplikasi Pelaporan Pajak Daerah Menggunakan Metode Penetration Testing Execution Standar,” Jurnal Sistim Informasi dan Teknologi, pp. 1–6, Mar. 2021, doi: 10.37034/jsisfotek.v3i1.36.

[2] H. Zhang, J. Wang, Y. Wang, M. Li, J. Song, and Z. Liu, “ICVTest: A Practical Black-Box Penetration Testing Framework for Evaluating Cybersecurity of Intelligent Connected Vehicles,” Applied Sciences (Switzerland), vol. 14, no. 1, Jan. 2024, doi: 10.3390/app14010204.

[3] F. Akmalia Maylani, M. Tahir, N. Nataswa Juniar, D. Sari, and W. Ayu Zulaica, “Analisis Keamanan Website E-Library Kampus dengan Metode PTES (Penetration Testing Execution Standard),” 2025.

[4] Hasibuan Marzuki and Elhanafi Andi Marwan, “Penetration Testing Sistem Jaringan Komputer Menggunakan Kali Linux untuk Mengetahui Kerentanan Keamanan Server dengan Metode Black Box,” sudo Jurnal Teknik Informatika, vol. 1, no. 4, pp. 171–177, Dec. 2022, doi: 10.56211/sudo.v1i4.160.

[5] K. U. Sarker, F. Yunus, and A. Deraman, “Penetration Taxonomy: A Systematic Review on the Penetration Process, Framework, Standards, Tools, and Scoring Methods,” Jul. 01, 2023, Multidisciplinary Digital Publishing Institute (MDPI). doi: 10.3390/su151310471.

[6] E. Hilario, S. Azam, J. Sundaram, K. Imran Mohammed, and B. Shanmugam, “Generative AI for pentesting: the good, the bad, the ugly,” Int. J. Inf. Secur., vol. 23, no. 3, pp. 2075–2097, Jun. 2024, doi: 10.1007/s10207-024-00835-x.

[7] N. O. Jaffal, M. Alkhanafseh, and D. Mohaisen, “Large Language Models in Cybersecurity: A Survey of Applications, Vulnerabilities, and Defense Techniques,” Sep. 01, 2025, Multidisciplinary Digital Publishing Institute (MDPI). doi: 10.3390/ai6090216.

[8] S. Ćirković, V. Mladenović, S. Tomić, D. Drljača, and O. Ristić, “Utilizing Fine-Tuning of Large Language Models for Generating Synthetic Payloads: Enhancing Web Application Cybersecurity through Innovative Penetration Testing Techniques,” Computers, Materials and Continua, vol. 82, no. 3, pp. 4409–4430, 2025, doi: 10.32604/cmc.2025.059696.

[9] C. Huang, X. Huang, N. P. Tran, and A. M. Fard, “Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning,” Journal of Cybersecurity and Privacy, vol. 6, no. 3, p. 84, May 2026, doi: 10.3390/jcp6030084.

[10] K. Lee, S. Yang, J. Jeong, Y. Lee, and D. Shin, “Enhancing Security and Applicability of Local LLM-Based Document Retrieval Systems in Smart Grid Isolated Environments,” Electronics (Switzerland), vol. 14, no. 17, Sep. 2025, doi: 10.3390/electronics14173407.

[11] H. Liu and J. Xu, “Empirical Analysis of Internal Hallucination Detection in Quantized LLMs: Layer Dynamics and White-Box Benchmarks,” Electronics (Basel)., vol. 15, no. 9, p. 1802, Apr. 2026, doi: 10.3390/electronics15091802.

[12] N. S. Mathews, Y. Brus, Y. Aafer, M. Nagappan, and S. McIntosh, “LLbezpeky: Leveraging Large Language Models for Vulnerability Detection,” Feb. 2024, [Online]. Available: http://arxiv.org/abs/2401.01269

[13] M. Amirul, N. Shamsudin, and M. F. Zolkipli, “A Comparative Analysis of Penetration Testing Tools for Network Vulnerability Assessment,” 2025. [Online]. Available: www.majmuah.com

[14] L. A. Pfuño Alccahuamani, A. Meza Bautista, and H. Rojas, “Hybrid Web Architecture with AI and Mobile Notifications to Optimize Incident Management in the Public Sector,” Computers, vol. 15, no. 1, p. 47, Jan. 2026, doi: 10.3390/computers15010047.

[15] M. Ridho, A. Hafizh, I. Dani, and T. Ariyadi, “Peningkatan Keamanan SSH Server Berbasis Linux melalui Implementasi Fail2Ban dan Uji Serangan Brute Force,” Jurnal Penelitian Multidisiplin Bangsa, vol. 1, no. 12, 2025, [Online]. Available: https://ejournal.amirulbangunbangsapublishing.com/index.php/jpnmb/index

[16] D. Moreira, J. P. Seara, J. P. Pavia, and C. Serrão, “Intelligent Platform for Automating Vulnerability Detection in Web Applications,” Electronics (Switzerland), vol. 14, no. 1, Jan. 2025, doi: 10.3390/electronics14010079.