Security Testing of the Systematic UNISI Website using the Penetration Testing Method

Abstract

Academic websites require continuous security evaluation because they support information publication and institutional services that are accessible through the internet. This study evaluates the security of the Sistemasi UNISI website using a non-destructive penetration testing method with OWASP Zed Attack Proxy (ZAP). The research stages consisted of literature study, planning, reconnaissance, scanning, vulnerability testing, report analysis, conclusion, and remediation formulation. Data were collected through literature review and observation of the target website, while testing was performed by entering the Sistemasi UNISI URL into the Automated Scan feature of OWASP ZAP. The detailed scan report identified 19 findings consisting of four medium-risk findings, eight low-risk findings, and seven informational findings, with no high-risk finding reported. The medium findings were absence of Anti-CSRF tokens, Content Security Policy header not set, missing anti-clickjacking header, and vulnerable JavaScript library. The results indicate that the website still requires security hardening, especially in browser security headers, cookie configuration, JavaScript dependency management, HTTPS consistency, and information disclosure control. The recommended improvements can reduce exploitation opportunities and strengthen the security posture of the website