Security Testing Cerdas
OWASP, SAST/DAST & AI Fuzzing

# ================================================================
# S11409 - Sesi 13: Security Testing Cerdas
# Mini SAST Scanner + Secure Coding Patterns
# Dosen: Riadi Marta Dinata, S.Ti., M.Kom. | ISTN Jakarta
# ================================================================

import re, ast, hashlib, hmac, secrets
from dataclasses import dataclass
from typing import List, Tuple

# ── BAGIAN 1: MINI SAST SCANNER ──────────────────────────────
@dataclass
class SecurityFinding:
    severity: str   # CRITICAL / HIGH / MEDIUM / LOW
    rule_id:  str
    message:  str
    line:     int
    code:     str

class MiniSASTScanner:
    """
    Scanner SAST ringan berbasis pattern matching.
    Mendeteksi pola kode berbahaya sesuai OWASP Top 10.
    """
    RULES = [
        # A03: SQL Injection
        ("CRITICAL", "A03-SQLi",
         r'(execute|query)\s*\(["\'][^"\']*["\'\+]\s*\w',
         "SQL query dengan string concatenation — risiko SQL Injection"),
        # A02: Hardcoded credentials
        ("CRITICAL", "A02-HardCred",
         r'(password|passwd|secret|api_key)\s*=\s*["\'][^"\']{6,}["\']',
         "Hardcoded credential — jangan commit ke repository!"),
        # A02: Weak hashing
        ("HIGH", "A02-WeakHash",
         r'\b(md5|sha1)\s*\(',
         "Algoritma hash lemah (MD5/SHA1) — gunakan bcrypt atau SHA-256+"),
        # A05: Debug mode
        ("HIGH", "A05-Debug",
         r'DEBUG\s*=\s*True',
         "Debug mode aktif — jangan di production!"),
        # A03: Command injection
        ("CRITICAL", "A03-CMDi",
         r'(os\.system|subprocess\.call|eval|exec)\s*\([^)]*\+',
         "Potensi command/code injection"),
        # A05: Sensitive data in URL
        ("MEDIUM", "A09-URLParam",
         r'(password|token|secret)=["\']?\w',
         "Data sensitif di URL parameter — gunakan body/header"),
        # A02: No SSL verification
        ("MEDIUM", "A02-NoSSL",
         r'verify\s*=\s*False',
         "SSL verification dinonaktifkan — rentan MITM attack"),
        # A07: No rate limiting hint
        ("LOW", "A07-NoLimit",
         r'def\s+(login|authenticate|signup)\s*\(',
         "Fungsi auth terdeteksi — pastikan ada rate limiting"),
    ]

    def scan_code(self, code: str, filename="") -> List[SecurityFinding]:
        findings = []
        lines = code.split('\n')
        for line_num, line in enumerate(lines, 1):
            for severity, rule_id, pattern, message in self.RULES:
                if re.search(pattern, line, re.IGNORECASE):
                    findings.append(SecurityFinding(
                        severity=severity, rule_id=rule_id,
                        message=message, line=line_num,
                        code=line.strip()
                    ))
        return findings

    def report(self, findings: List[SecurityFinding], filename: str):
        if not findings:
            print(f"  [OK] {filename}: No security issues found!")
            return
        sev_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
        findings.sort(key=lambda f: sev_order.get(f.severity, 9))
        print(f"\n  Security scan: {filename}")
        print(f"  Found {len(findings)} issue(s)\n")
        for f in findings:
            icon = {"CRITICAL":"!!","HIGH":"! ","MEDIUM":"* ","LOW":"- "}
            print(f"  [{icon.get(f.severity,'?')}] [{f.severity:<8}] Line {f.line} | {f.rule_id}")
            print(f"      {f.message}")
            print(f"      Code: {f.code[:70]}")
            print()

# ── BAGIAN 2: VULNERABLE CODE CONTOH ─────────────────────────
VULNERABLE_CODE = '''
import sqlite3, hashlib, os

DEBUG = True
API_KEY = "sk-prod-abc123xyz789secret"

def login(username, password):
    conn = sqlite3.connect("siakad.db")
    # VULNERABLE: SQL Injection!
    query = "SELECT * FROM users WHERE username = '" + username + "'"
    result = conn.execute(query)

    # VULNERABLE: MD5 hash yang lemah!
    hashed = hashlib.md5(password.encode()).hexdigest()
    return result.fetchone()

def reset_password(token, new_password):
    # VULNERABLE: SSL verification off!
    import requests
    requests.post("https://api.istn.ac.id/reset",
                  data={"token": token, "password": new_password},
                  verify=False)
'''

# ── BAGIAN 3: SECURE CODE YANG BENAR ─────────────────────────
def secure_login_demo(username: str, password: str) -> dict:
    """
    Demonstrasi secure coding practices:
    1. Parameterized query (anti SQL injection)
    2. bcrypt / hashlib.pbkdf2 (secure password hashing)
    3. Constant-time comparison (anti timing attack)
    """
    import sqlite3, hashlib, os

    # SECURE: Parameterized query — tidak bisa di-inject
    # conn.execute("SELECT * FROM users WHERE username = ?", (username,))

    # SECURE: PBKDF2 dengan salt acak — jauh lebih kuat dari MD5
    salt   = os.urandom(32)
    key    = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100_000)
    stored = salt + key   # simpan keduanya bersama

    # SECURE: Verifikasi dengan hmac.compare_digest (constant-time)
    # Mencegah timing attack yang bisa menebak password karakter per karakter
    test_key = hashlib.pbkdf2_hmac('sha256', password.encode(),
                                    stored[:32], 100_000)
    is_valid = hmac.compare_digest(key, test_key)

    # SECURE: Generate secure token untuk session
    session_token = secrets.token_urlsafe(32)

    return {
        "authenticated": is_valid,
        "session_token": session_token,
        "note": "Token hanya berlaku 30 menit, rotasi setelah digunakan"
    }

def validate_input_demo(user_input: str) -> Tuple[bool, str]:
    """Input validation untuk mencegah injection"""
    # Whitelist approach: hanya izinkan karakter yang diharapkan
    import re
    if not re.match(r'^[a-zA-Z0-9._@-]{3,50}$', user_input):
        return False, "Input tidak valid — hanya huruf, angka, . _ @ - diperbolehkan"
    # Sanitize: escape karakter HTML untuk mencegah XSS
    sanitized = (user_input
                 .replace('&', '&')
                 .replace('<', '<')
                 .replace('>', '>')
                 .replace('"', '"'))
    return True, sanitized


# ── MAIN ──────────────────────────────────────────────────────
print("=" * 60)
print("    SECURITY TESTING DEMO")
print("    S11409 ISTN Jakarta | Sesi 13")
print("=" * 60)

scanner = MiniSASTScanner()

print("\n[1] SAST Scan — Vulnerable Code:")
findings = scanner.scan_code(VULNERABLE_CODE, "siakad_auth.py")
scanner.report(findings, "siakad_auth.py")

print("[2] Secure Coding Demo:")
result = secure_login_demo("mahasiswa@istn.ac.id", "P@ssw0rd123")
print(f"  Authenticated : {result['authenticated']}")
print(f"  Session token : {result['session_token'][:20]}...")

print("\n[3] Input Validation:")
test_inputs = [
    "riadi.marta@istn.ac.id",
    "'; DROP TABLE users; --",
    "",
    "NIM_2024001",
]
for inp in test_inputs:
    valid, result = validate_input_demo(inp)
    status = "SAFE" if valid else "BLOCKED"
    print(f"  [{status}] {inp[:40]:<40} -> {result[:30]}")

print("\nDone! Security scan selesai.")