Evaluasi Teknik Penyadapan Lalu Lintas Data Dengan Session Hijacking Pada Protokol HTTP
DOI:
https://doi.org/10.30872/jim.v14i2.1798Keywords:
Session hijacking, fisher-yates shuffle, linear congruent method, HTTPAbstract
Hyper Text Transfer Protocol (HTTP) merupakan protokol jaringan aplikasi yang digunakan pada aplikasi berbasis web. Kerentanan protokol ini yang mengekspoitasi web server secara tidak aman, memberikan peluang peretas untuk melakukan serangan, salah satunya dengan serangan session hijacking. Oleh karena itu, dalam penelitian ini dilakukan survei kerentanan terhadap session hijacking dengan menguji beberapa web. Untuk mendapatkan data, maka digunakan Wi-fi UC browser untuk membaca lalulintas data protokol jaringan HTTP yang sedang dibuka oleh pengguna. Dalam pengujian diperoleh cookies yang digunakan oleh pengguna. Informasi session id yang terekam dalam penyadapan, dapat disalahgunakan oleh attacker untuk melakukan tindakan illegal. Hasil penelitian menunjukkan kelemahan pada protokol jaringan HTTP yang rentan terhadap penyadapan lalulintas data dengan cara penyerangan session hijacking. Untuk mengatasi kelemahan ini, dapat digunakan metode pengacakan seperti algoritme Fisher-Yates shuffle atau pun algoritme Linear Congruent Method yang dapat meningkatkan keamanan.
References
G. Namit, S. Abakash, S. Dheeraj, “Web Application Firewall”. CS499: B. Tech Project Final Report, 2008.
N. Mor, O. Riva, S. Nath and J. Kubiatowicz, "Bloom Cookies: Web Search Personalization without User Tracking", Proceedings 2015, San Diego, CA, USA, Feb. 2015.
S. Sivakorn, I. Polakis and A.D. Keromytis, "The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information", IEEE, New York, USA, 2016.
S.K. Chung, O.C. Yee, M.M Singh danR. Hassan, "SQL Injections Attack and Session Hijacking on E-Learning Systems," 2014 IEEE, Langkawi, Kedah, Malaysia, Sept., 2014.
N. Angsar, “Pengujian Statis pada Sistem ServerWeb berbasis Cluster dengan Algoritma Never Queue”, JNTETI, vol. 7, no. 3, pp.297-301, Agust. 2018.
J.J. Pauli, P.H. Engebretson, M.J. Ham dan M.J. Zautke, "CookieMonster: Automated Session Hijacking Archival and Analysis", 2011 IEEE, Las Vegas, Apr., 2011.
M. Arifin, A. Bejo dan W. Najib, "Integrasi Login tanpa Mengetik Password pada WordPress", JNTETI, vol. 6, no. 2, pp. 162-167, Mei. 2017.
S. Wedman, A. Tetmeyer and H. Saiedian, "An Analytical Study of Web Application Session Management Mechanisms and HTTP Session Hijacking Attacks", Information Security Journal: A Global Perspective, 2014.
K. D’silva, Vanajakshi J, Manjunath KN and S. Prabhu, "An Effective Method for Preventing SQL Injection Attack and Session Hijacking", IEEE International Conference On, Bangalore, India, May 19-20, 2017.
D.S. Utama dan Y. Asriningtias, "Perbandingan waktu akses algoritma Fisher-Yates Shuffledan Linear Congruent Method pada soal Try-Out Berbasis web", JISKa, vol. 2, no. 2, pp. 93-102, Sept., 2017.
K.A. Shaikh, K. Bhat A and M. Moharir, "A Survey on SSL packet structure", IEEE International Conference on, Bangalore, India, dec., 2017
Downloads
Additional Files
Published
Issue
Section
License
Copyright Transfer StatementThe copyright of this article is transferred to Informatika Mulawarman : Jurnal Ilmiah Ilmu Komputer and when the article is accepted for publication. the authors transfer all and all rights into and to paper including but not limited to all copyrights in the Informatika Mulawarman. The author represents and warrants that the original is the original and that he/she is the author of this paper unless the material is clearly identified as the original source, with notification of the permission of the copyright owner if necessary. The author states that he has the authority and authority to make and carry out this task.
The author states that:
- This paper has not been published in the same form elsewhere.
- This will not be submitted elsewhere for publication prior to acceptance/rejection by this Journal.
A Copyright permission is obtained for material published elsewhere and who require permission for this reproduction. Furthermore, I / We hereby transfer the unlimited publication rights of the above paper to Informatika Mulawarman : Jurnal Ilmiah Ilmu Komputer. Copyright transfer includes exclusive rights to reproduce and distribute articles, including reprints, translations, photographic reproductions, microforms, electronic forms (offline, online), or other similar reproductions.
The author's mark is appropriate for and accepts responsibility for releasing this material on behalf of any and all coauthor. This Agreement shall be signed by at least one author who has obtained the consent of the co-author (s) if applicable. After the submission of this agreement is signed by the author concerned, the amendment of the author or in the order of the author listed shall not be accepted.
Rights / Terms and Conditions Saved
- The author keeps all proprietary rights in every process, procedure, or article creation described in Work.
- The author may reproduce or permit others to reproduce the work or derivative works for the author's personal use or for the use of the company, provided that the source and the Informatika Mulawarman copyright notice are indicated, the copy is not used in any way implying the Journal of Informatika Mulawarman (JIM) approval of the product or service from any company, and the copy itself is not offered for sale.
- Although authors are permitted to reuse all or part of the Works in other works, this does not include granting third-party requests to reprint, republish, or other types of reuse.
Informatika Mulawarman by http://e-journals.unmul.ac.id/index.php/JIM/index is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
under the CC BY-SA license, authors and other users are able to reprint, distribute or use the material for commercial purposes so long as they give attribution to the journal Informatika Mulawarman and license the republished material under the same license.
