Imported from firebitsbr/Writeups-claudeskills (claudeskills/writeup-fiantinangon/SKILL.md). Install upstream with npx skills add firebitsbr/Writeups-claudeskills --skill writeup-fiantinangon. Copyright stays with the author.

name: writeup-fiantinangon description: CTF writeups and security challenges by fiantinangon.

Writeups by fiantinangon

Name: writeup-fiantinangon
Author: firebitsbr

Source repository: /repos/fiantinangon

Repository Index

mari-pentest/CHANGELOG.md
mari-pentest/DOCKER-QUICKSTART.md
mari-pentest/QUICK-START.md
mari-pentest/README.md

Writeup Content

File: mari-pentest/README.md

Mari Pentest Tools

Internal security testing platform by Mariworks. Covers the full pentest workflow — recon, vulnerability scanning, and reporting — from a single web dashboard.

 ███╗   ███╗ █████╗ ██████╗ ██╗
 ████╗ ████║██╔══██╗██╔══██╗██║
 ██╔████╔██║███████║██████╔╝██║
 ██║╚██╔╝██║██╔══██║██╔══██╗██║
 ██║ ╚═╝ ██║██║  ██║██║  ██║██║
 ╚═╝     ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  PENTEST TOOLS v4.1

Version Python AI ZAP License

Fitur

Swiss Army Knife — 6 Built-in Security Tools

Tool	Durasi	Deskripsi
PORT SCAN	~3 menit	TCP port scanner dengan service detection & risk assessment
DNS RECON	~30 detik	Full DNS record enumeration (A/MX/NS/TXT/SPF/DMARC/DKIM)
SUBDOMAINS	~60 detik	Brute-force subdomain discovery + subdomain takeover detection
SSL DEEP	~20 detik	Analisis TLS: sertifikat, cipher suite, protokol, HSTS
WHOIS / IP	~10 detik	IP intel, ASN, geolocation, cloud provider detection
API TESTER	~60 detik	18 automated security checks untuk web API & aplikasi web

Full Recon Campaign

Jalankan semua (atau pilihan) tools sekaligus dalam satu pipeline otomatis. Menghasilkan laporan lengkap dengan executive summary scorecard. Kini mendukung Web Vulnerability Scan via ZAP sebagai tahap opsional dalam pipeline.

OWASP ZAP Integration

Tiga mode: Quick (5–10 mnt), Standard (15–30 mnt), Full (1–2 jam)
Spider + active scan + passive analysis
Auth support: Form login, HTTP Basic, Bearer token, Cookie
Reusable encrypted auth profiles + scan queue

PDF Download

Semua jenis report kini bisa diunduh sebagai PDF profesional langsung dari browser — tanpa dependency tambahan, tanpa konfigurasi server.

Tombol ↓ PDF tersedia di header setiap report
ZAP Scan report → PDF landscape A4
Full Recon Campaign report → PDF portrait A4 (seluruh section di-expand otomatis)
Individual tool report → PDF portrait A4

AI Analysis

Executive Summary untuk non-teknis
Detailed Vulnerability Analysis dengan CWE mapping
Step-by-step Remediation Guide
Secure vs Vulnerable Code Examples

Arsitektur

┌──────────────────────────────────────────────────────────────────┐
│                    Browser (port 5001)                           │
│                   Dark Terminal Dashboard                        │
└───────────────────────────┬──────────────────────────────────────┘
                            │ HTTP
┌───────────────────────────▼──────────────────────────────────────┐
│                     Flask App (app.py)                           │
│                                                                  │
│  ┌───────────────┐  ┌────────────────┐  ┌──────────┐  ┌──────────┐  │
│  │ Swiss Tools   │  │   Campaign     │  │ ZAP Scan │  │  AI API  │  │
│  │  6 tools      │  │ 6 tools + ZAP* │  │  3 mode  │  │  AI API  │  │
│  └──────┬────────┘  └───────┬────────┘  └────┬─────┘  └────┬─────┘  │
│         └─────────────────┴──────────────┴─────────────┘          │
│                   * ZAP opsional di Campaign (opt-in)              │
│                           │                                      │
│              ┌────────────▼────────────┐                         │
│              │   SQLite Database       │                         │
│              │  tool_scans, campaigns  │                         │
│              │  scans, auth_profiles   │                         │
│              └─────────────────────────┘                         │
└───────────────────────────┬──────────────────────────────────────┘
                            │ ZAP Java API
┌───────────────────────────▼──────────────────────────────────────┐
│                  OWASP ZAP (port 8081)                          │
└──────────────────────────────────────────────────────────────────┘

Stack:

Backend: Python 3 + Flask
Database: SQLite — data/mari_scanner.db
Scanner: OWASP ZAP 2.17.0
AI: Anthropic (provider lain menyusul)
Frontend: Vanilla JS + Tailwind CSS + Fira Code

Ports:

Service	Host	Container
Web Dashboard	5001	5000
ZAP API	8081	8080

Port 5001 dipilih menghindari konflik macOS AirPlay Receiver (5000) dan common services (8080).

Instalasi

Docker (Recommended)

Prasyarat: Docker Desktop terinstal dan running.

One-liner

git clone https://github.com/fiantinangon/mari-pentest.git
cd mari-pentest
bash install.sh

Script otomatis: fix permissions → cek Docker → build image → start container → health check → buka browser.

First time setup: Download ~1 GB (ZAP + JDK). Tunggu sekitar 5–10 menit.

Manual

git clone https://github.com/fiantinangon/mari-pentest.git
cd mari-pentest

# Set API key (opsional, untuk AI)
export ANTHROPIC_API_KEY="sk-ant-..."

docker compose up -d --build

# Cek status
docker compose ps

Dashboard: http://localhost:5001

Helper Scripts

./install.sh  # First time — fix permissions + launch
./run.sh      # Start (setelah install pertama kali)
./stop.sh     # Stop containers
./restart.sh  # Rebuild dan restart
./logs.sh     # Follow live logs

Set API Key via Dashboard (tanpa restart)

Buka http://localhost:5001
Klik AI ASSIST di navbar → scroll bawah
Masukkan API key → Save

macOS Native (Tanpa Docker)

Untuk development atau jika tidak mau pakai Docker.

# Install dependencies
brew install openjdk@11 python@3.11

# Apple Silicon — link Java
sudo ln -sfn /opt/homebrew/opt/openjdk@11/libexec/openjdk.jdk \
    /Library/Java/JavaVirtualMachines/openjdk-11.jdk

# Python packages
pip3 install -r requirements.txt

# Download ZAP
cd /tmp
wget https://github.com/zaproxy/zaproxy/releases/download/v2.17.0/ZAP_2.17.0_Linux.tar.gz
sudo tar -xzf ZAP_2.17.0_Linux.tar.gz -C /opt/
sudo ln -s /opt/ZAP_2.17.0 /opt/zap

# Jalankan
export ANTHROPIC_API_KEY="sk-ant-..."
export _JAVA_OPTIONS="-Xmx2g"
python3 app.py

Catatan: Swiss Army tools dan Campaign (tanpa ZAP) berjalan tanpa ZAP daemon. ZAP diperlukan untuk: Quick/Standard/Full scan via New Scan, dan Campaign dengan opsi "WEB VULN (ZAP)" dicentang.

Linux Native

sudo apt update && sudo apt install -y python3 python3-pip default-jdk wget

pip3 install -r requirements.txt --break-system-packages

# Download ZAP
cd /tmp
wget https://github.com/zaproxy/zaproxy/releases/download/v2.17.0/ZAP_2.17.0_Linux.tar.gz
sudo tar -xzf ZAP_2.17.0_Linux.tar.gz -C /opt/
sudo ln -s /opt/ZAP_2.17.0 /opt/zap

export ANTHROPIC_API_KEY="sk-ant-..."
export _JAVA_OPTIONS="-Xmx2g"
python3 app.py

Tutorial Lengkap

Swiss Army Knife Tools

Tools individual untuk recon cepat. Akses via klik tab TOOLS di dashboard.

Port Scanner

Mendeteksi port terbuka dan service yang berjalan.

Cara pakai:

Pilih PORT SCAN dari sidebar kiri
Masukkan target:
```
example.com
192.168.1.1
10.0.0.50
```
Pilih range port (opsional):
- top1000 — 1000 port paling umum (default, ~3 menit)
- top100 — 100 port paling umum (~30 detik)
- full — semua 65535 port (bisa >10 menit)
Klik RUN TOOL
Klik 👁 di history untuk lihat report

Contoh skenario:

# Recon server production
Target: api.company.com
Range: top1000

# Cek LAN device
Target: 192.168.1.1
Range: full

# Quick check
Target: testsite.com
Range: top100

Apa yang dicari di hasil:

Port database terbuka ke internet (MySQL 3306, Redis 6379, MongoDB 27017) → HIGH
Telnet (23), FTP (21) → HIGH (unencrypted)
SSH (22) exposed → MEDIUM (brute-force risk)
HTTP (80) tanpa HTTPS redirect → MEDIUM

DNS Recon

Enumerasi semua DNS record dan analisis konfigurasi email security.

Cara pakai:

Pilih DNS RECON
Masukkan domain (tanpa https://):
```
example.com
sub.example.com
```
Klik RUN TOOL — selesai ~30 detik

Record yang diperiksa:

Record	Contoh	Yang Dicek
A	`93.184.216.34`	IP address server
AAAA	`2606:2800::1`	IPv6 address
MX	`mail.example.com`	Mail server, priority
NS	`ns1.example.com`	Nameserver
TXT	`v=spf1 include:...`	SPF, DKIM, verifikasi domain
CNAME	`example.cdn.net`	Alias / CDN
SOA	—	Authority, serial, TTL
SPF	`v=spf1 ...`	Email spoofing protection
DMARC	`v=DMARC1; p=reject`	Email auth policy
DKIM	Public key TXT	Email signing
DNSSEC	—	DNS tampering protection

Apa yang dicari di hasil:

SPF missing atau ~all (softfail) → domain bisa digunakan email spoofing
DMARC missing atau p=none → tidak ada enforcement
DKIM missing → email tidak tersigning
NS berbeda dari yang diexpect → kemungkinan hijack

Subdomain Enumeration

Brute-force discover subdomain menggunakan wordlist built-in 150+ kata + deteksi takeover.

Cara pakai:

Pilih SUBDOMAINS
Masukkan domain:
```
example.com
```
Klik RUN TOOL — ~60 detik

Wordlist yang digunakan (contoh): www, mail, api, dev, staging, test, admin, beta, cdn, static, assets, img, media, app, portal, dashboard, vpn, remote, backup, ftp, smtp, pop, imap, ...

Subdomain Takeover Detection:

Jika subdomain pointing ke CNAME yang tidak aktif di layanan cloud, akan ditandai HIGH:

Provider	Contoh tanda
GitHub Pages	`There isn't a GitHub Pages site here`
Heroku	`No such app`
Netlify	`Not Found - Request ID`
Fastly	`Fastly error: unknown domain`
AWS S3	`NoSuchBucket`
Azure	`404 Web Site not found`

Contoh temuan:

staging.example.com → CNAME → example.github.io [DANGLING — HIGH]
cdn.example.com     → A → 1.2.3.4 [OK]
api.example.com     → A → 1.2.3.5 [OK]

SSL Deep Analyzer

Analisis mendalam konfigurasi TLS/SSL target.

Cara pakai:

Pilih SSL DEEP
Masukkan domain:
```
example.com
```
Klik RUN TOOL — ~20 detik

Yang dianalisis:

Aspek	Baik	Masalah
Sertifikat valid	Valid, trusted CA	Expired / self-signed
Sisa masa berlaku	> 30 hari	≤ 30 hari → MEDIUM, expired → HIGH
Key size (RSA)	≥ 2048 bit	< 2048 bit → HIGH
Protokol TLS	TLS 1.2, TLS 1.3	TLS 1.0 / 1.1 → HIGH (deprecated)
Cipher suite	AES-GCM, ChaCha20	RC4, DES, 3DES → HIGH
HSTS header	Present + max-age ≥ 31536000	Missing → MEDIUM
Subject Alt Names	Cocok dengan domain	Mismatch → HIGH
Issuer	Let's Encrypt, DigiCert, dll	Unknown CA → MEDIUM

WHOIS / IP Intel

Lookup informasi registrar, ASN, geolocation, dan cloud provider.

Cara pakai:

Pilih WHOIS / IP
Masukkan domain atau IP:
```
example.com
8.8.8.8
192.168.1.1
```
Klik RUN TOOL — ~10 detik

Output:

Domain:     example.com
Registrar:  GoDaddy.com, LLC
Registered: 1995-08-14
Expires:    2024-08-13  ← jika dekat, domain mungkin expired

IP:         93.184.216.34
ASN:        AS15133 (MCI Communications)
Country:    US / California
ISP:        Edgecast Networks
Cloud:      Fastly CDN ← deteksi AWS/GCP/Azure/Cloudflare/Fastly/dll
CIDR:       93.184.216.0/24

API Security Tester

18 automated checks untuk web API, REST endpoint, dan aplikasi web umum.

Cara pakai:

Pilih API TESTER

Masukkan URL target (dengan protokol):

https://api.example.com
https://example.com
https://app.example.com/api

Klik RUN TOOL — ~60 detik

18 Security Checks — Detail:

Check 1: HTTPS + HSTS Enforcement

Mengirim request HTTP dan cek redirect ke HTTPS + HSTS header.

Test:  http://example.com → apakah redirect ke https://?
Test:  Apakah ada header Strict-Transport-Security?

PASS:   HTTP 301 → https:// + HSTS dengan max-age ≥ 31536000
MEDIUM: Redirect HTTPS tapi tidak ada HSTS
HIGH:   Tidak ada redirect HTTPS (traffic bisa di-intercept)

Check 2: Security Headers

Cek keberadaan 6 security header penting:

Content-Security-Policy      (HIGH jika missing)
Strict-Transport-Security    (MEDIUM jika missing)
X-Frame-Options              (MEDIUM — clickjacking protection)
X-Content-Type-Options       (LOW — MIME sniffing protection)
Referrer-Policy              (LOW — referrer leakage)
Permissions-Policy           (LOW — browser feature control)

Check 3: Server Version Disclosure

Cek header yang bisa mengekspos versi server:

Server: nginx/1.18.0          ← versi terekspos
X-Powered-By: PHP/8.1.2       ← versi terekspos
X-AspNet-Version: 4.0.30319   ← versi terekspos

LOW jika ada digit versi di header-header ini.
Remediation: Remove atau strip versi dari header.

Check 4: WAF Detection

Deteksi keberadaan Web Application Firewall:

Signature yang dicek:
cf-ray            → Cloudflare
x-sucuri-id       → Sucuri
x-iinfo           → Imperva Incapsula
x-amzn-requestid  → AWS WAF/CloudFront
x-azure-ref       → Azure Front Door

INFO jika WAF terdeteksi (good).
MEDIUM jika tidak ada WAF — tidak ada proteksi aplikasi layer.

Check 5: CORS Misconfiguration

Mengirim 3 request dengan origin berbeda dan analisis response:

Test origins:
1. https://evil.com
2. null
3. https://target.evil.com  (subdomain bypass)

Evaluasi:
Access-Control-Allow-Origin: *
  → MEDIUM (wildcard, OK untuk public API tapi bukan API dengan auth)

Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
  → HIGH! Credential theft possible — attacker bisa baca response dengan cookie user

Access-Control-Allow-Origin: https://evil.com  (tanpa credentials)
  → MEDIUM

Contoh kode yang rentan (backend):

# RENTAN — jangan lakukan ini
response.headers['Access-Control-Allow-Origin'] = request.headers.get('Origin')
response.headers['Access-Control-Allow-Credentials'] = 'true'

# AMAN — whitelist eksplisit
ALLOWED_ORIGINS = {'https://app.example.com', 'https://dashboard.example.com'}
origin = request.headers.get('Origin', '')
if origin in ALLOWED_ORIGINS:
    response.headers['Access-Control-Allow-Origin'] = origin

Check 6: Rate Limiting

Mengirim 20 request berturut-turut dan cek apakah ada pembatasan:

Indikator rate limiting yang dicek:
- HTTP 429 (Too Many Requests)
- Header X-RateLimit-Limit
- Header X-RateLimit-Remaining
- Header Retry-After

HIGH jika 20/20 request berhasil tanpa throttling.
Rentan terhadap: brute force, credential stuffing, DoS.

Remediation:
  nginx: limit_req zone=api burst=20 nodelay;
  Express: express-rate-limit middleware
  Flask: flask-limiter

Check 7: API Key / Secret Exposure

Scan response body dan headers untuk pattern API key/secret:

Pattern yang dicek:
AKIA[0-9A-Z]{16}                    → AWS Access Key
sk-ant-[a-zA-Z0-9\-_]{40,}          → Anthropic API Key
AIza[0-9A-Za-z\-_]{35}              → Google API Key
ghp_[a-zA-Z0-9]{36}                 → GitHub Personal Token
xoxb-[0-9]{11}-[0-9]{11}-...       → Slack Bot Token
(?i)api[_-]?key.*[:=].*[a-z0-9]{20,} → Generic API Key

HIGH jika ditemukan. Rotasi key segera!

Check 8: JWT Token Weakness

Mencari JWT di response body dan Authorization header, lalu decode dan analisis:

Test:
1. alg: none → CRITICAL — JWT bisa diforgery tanpa signature
2. alg: HS256/HS384/HS512 → MEDIUM — symmetric, secret bisa di-brute-force
3. Tidak ada field exp → HIGH — token tidak pernah expire

Contoh JWT yang bermasalah (header):
{
  "alg": "none",     ← CRITICAL
  "typ": "JWT"
}

Contoh payload bermasalah:
{
  "sub": "user123",
  "role": "admin"
  // tidak ada "exp" field → HIGH
}

Remediation:
- Gunakan RS256 atau ES256 (asymmetric)
- Selalu set exp (misal: 15 menit untuk access token)
- Reject alg=none di server

Check 9: GraphQL Introspection

Probe path-path GraphQL umum dengan query introspection:

Paths yang dicoba:
/graphql, /api/graphql, /gql, /query, /graphiql

Query test:
{ __schema { queryType { name } } }

HIGH jika introspection berhasil → full schema terekspos.
Attacker bisa enumerate semua queries, mutations, types.

Remediation:
  Apollo: introspection: process.env.NODE_ENV !== 'production'
  Graphene: schema = graphene.Schema(..., auto_camelcase=False)

Check 10: API Endpoint Discovery

Probe ~25 path umum untuk menemukan endpoint yang exposed:

Paths yang dicek:
/swagger.json, /swagger.yaml    → API documentation exposed
/openapi.json, /openapi.yaml    → OpenAPI spec exposed
/api-docs, /api/docs            → Swagger UI
/v1, /v2, /v3                   → API versions
/health, /healthz, /ping        → Health endpoints
/metrics                        → Prometheus metrics (internal data!)
/info                           → Application info
/.well-known/security.txt       → Security contact
/robots.txt, /sitemap.xml       → Crawler hints

INFO jika ditemukan — bukan selalu masalah, tapi perlu review.

Check 11: Backup File Scanner

Probe ~20 path backup dan file sensitif:

Paths yang dicek:
/.env                   → Environment variables (database URL, secrets!)
/.env.bak, /.env.old
/.git/HEAD              → Git repository exposed
/.git/config
/config.php.bak
/database.sql           → Database dump!
/backup.sql
/backup.zip
/web.config.bak         → IIS config
/wp-config.php.bak      → WordPress config
/.htpasswd              → Basic auth credentials
/settings.py.bak

HIGH jika file 200 OK dengan content > 50 byte.
MEDIUM jika 403 (exists tapi restricted).

Check 12: Admin Panel Discovery

Probe path admin panel umum:

/admin, /admin/login
/wp-admin               → WordPress admin
/phpmyadmin, /pma       → phpMyAdmin (database GUI!)
/panel, /cpanel
/dashboard, /manager
/console, /backend

MEDIUM jika accessible (200 atau redirect ke login).

Check 13: Debug Endpoint Exposure

Probe endpoint debug Spring Boot Actuator dan framework lain:

/actuator               → Spring Boot Actuator root
/actuator/env           → Environment variables TEREKSPOS!
/actuator/beans         → Spring bean definitions
/actuator/heapdump      → Memory dump (sangat berbahaya!)
/actuator/mappings      → Semua URL mappings
/debug, /_debug         → Debug panel
/debug/vars             → Go runtime variables

HIGH jika /actuator/heapdump atau /actuator/env accessible.

Check 14: PII Detection

Scan response body untuk pattern data pribadi:

Pattern yang dicek:
Email:          user@example.com
Indonesian Phone: +62812xxxx / 0812xxxx
NIK (KTP):     16-digit number
SSN Pattern:   xxx-xx-xxxx

MEDIUM jika ditemukan.
Remediation: Data minimization, masking di API response.

Check 15: Credit Card Leakage

Scan response untuk nomor kartu kredit valid (verifikasi Luhn algorithm):

Pattern: Visa (4xxx), Mastercard (5xxx), Amex (3xxx), Discover (6011...)
Verifikasi Luhn — hanya flag nomor yang valid secara algoritma.

HIGH jika ditemukan nomor kartu valid.
Ini pelanggaran PCI-DSS serius — segera hapus dan audit.

Check 16: Internal IP Disclosure

Cari alamat IP internal di response body dan headers:

Range yang dicari:
192.168.0.0/16    → Private LAN
10.0.0.0/8        → Private LAN
172.16.0.0/12     → Private LAN

Lokasi yang dicek: response body + semua response headers

MEDIUM jika ditemukan.
Bisa mengekspos topologi internal network.

Check 17: Stack Trace Detection

Cari error message / stack trace yang terekspos:

Pattern yang dicek:
Traceback (most recent call last)    → Python
NullPointerException                 → Java
at org.springframework.*             → Spring
Fatal error: ... on line N           → PHP
Warning: ... in ... on line N        → PHP
ActiveRecord::*Error                 → Ruby on Rails
Whoops! There was an error           → Laravel

HIGH jika ditemukan. Mengekspos teknologi stack, file paths, logic.
Remediation: disable debug mode, custom error pages.

Check 18: SSRF Passive Hint

Test passive untuk Server-Side Request Forgery:

Request: GET /?url=http://169.254.169.254/latest/meta-data/
(AWS metadata endpoint — internal, tidak boleh diakses dari public)

Bandingkan response size dan status dengan request normal.
Jika berbeda signifikan (>500 byte diff atau status beda) → MEDIUM hint.

Catatan: Ini passive hint, bukan confirmed SSRF.
Manual testing diperlukan untuk konfirmasi.

Full Recon Campaign

Jalankan semua tools dalam satu pipeline otomatis terhadap satu target. Mulai v4.1, pipeline kini mencakup Web Vulnerability Scan (OWASP ZAP) sebagai tahap opsional.

Cara pakai:

Klik FULL RECON di navbar

Masukkan target:

example.com
https://api.company.com
192.168.1.1

Pilih tools (centang/uncentang):
- ☑ PORT SCAN (~3 mnt)
- ☑ DNS RECON (~30 dtk)
- ☑ SUBDOMAINS (~60 dtk)
- ☑ SSL DEEP (~20 dtk)
- ☑ WHOIS / IP (~10 dtk)
- ☑ API TESTER (~60 dtk)
- ☐ WEB VULN (ZAP) (~10–30 mnt) ← opt-in, butuh ZAP daemon
Klik LAUNCH CAMPAIGN

Catatan ZAP di Campaign: ZAP dijalankan terakhir setelah semua recon tool selesai. Progress ZAP di-mirror secara real-time ke pipeline view. Jika ZAP tidak terinstall, tool ini akan gagal gracefully dan campaign tetap menjadi status partial (tools lain tetap jalan).

Urutan eksekusi (dioptimalkan):

WHOIS → DNS → SUBDOMAINS → SSL → PORTS → API TESTER → [ZAP jika dipilih]
         (broadest/fastest first, ZAP last karena terlama)

Pipeline View (dengan ZAP):

[ WHOIS     ] ████████████████ DONE    ✓ 10s
[ DNS       ] ████████████████ DONE    ✓ 28s
[ SUBDOMAINS] ████████████████ DONE    ✓ 55s
[ SSL       ] ████████████████ DONE    ✓ 19s
[ PORTS     ] ████████████████ DONE    ✓ 3m 12s
[ API       ] ████████████████ DONE    ✓ 1m 04s
[ WEB VULN  ] ████████░░░░░░░░ 55%     ↻ running... (ZAP active scan)

Campaign Report berisi:

Executive Summary scorecard: Open Ports / SSL Issues / Subdomains / Email Security / API Risk / Web Vulns (ZAP)
HIGH findings alert banner
Detail per tool (collapsible)
Discovered endpoints, admin panels, backup files
Sensitive data findings (PII, API keys, dll)
Section "WEB VULN SCAN (ZAP)" — jika ZAP dipilih:
- Jumlah High/Medium/Low/Info dari ZAP
- Tabel temuan dikelompokkan per risk level
- Link ke full ZAP report lengkap (/report/<id>)
Tombol ↓ PDF untuk download seluruh report sebagai PDF

OWASP ZAP Scanner

Scanner aktif berbasis OWASP ZAP untuk web vulnerability scanning mendalam. Berbeda dari Swiss Army tools yang bersifat pasif/informatif, ZAP secara aktif mencoba menyerang target untuk menemukan vulnerability nyata.

Cara Menjalankan Scan

Di dashboard utama → tab NEW SCAN

Masukkan Target URL (harus https:// atau http://):

https://example.com
https://app.company.com/api
http://192.168.1.100:8080

Pilih Scan Type:

Type	Durasi	Cara Kerja
Quick	5–10 mnt	Spider crawl + passive analysis saja. Tidak mengirim payload aktif. Aman untuk production.
Standard	15–30 mnt	Spider + active scan dengan medium strength. Mengirim payload XSS, SQLi, dll.
Full	1–2 jam	Spider agresif + deep active scan dengan semua rules aktif. Paling komprehensif.

Pilih Auth Profile (opsional) — jika halaman yang mau di-scan butuh login dulu
Klik Start Scan

Scan akan masuk antrian otomatis jika ada scan lain yang sedang berjalan.

ZAP Scan vs Swiss Army Tools

	Swiss Army Tools	ZAP Scanner
Cara kerja	Pasif — baca konfigurasi, header, record	Aktif — inject payload, spider crawl
Kecepatan	10 detik – 3 menit	5 menit – 2 jam
Yang ditemukan	Misconfiguration, info leakage	XSS, SQLi, CSRF, SSRF, RCE, dll
Auth support	Tidak	Form, Basic, Bearer, Cookie
Butuh ZAP	Tidak	Ya (Docker: sudah include)
Cocok untuk	Recon awal, pentest API	Deep web app security testing

Memahami Hasil Scan — Dashboard

Di dashboard, setiap scan tampil dengan:

Status: Pending → Running (dengan %) → Completed / Failed
Alert counts: jumlah HIGH / MED / LOW / INFO
Tombol 👁 — buka report detail

Memahami Scan Report (`/report/<id>`)

Report dibuka otomatis setelah klik 👁. Struktur halaman:

Header

SECURITY SCAN REPORT
// Generated by OWASP ZAP [QUICK/STANDARD/FULL]
https://example.com                          SCAN #42
                                             2026-02-25 10:30:00 UTC
                                             Duration: 8m 14s
[ ▶ AI ASSIST ]  [ ↓ Raw ZAP ]

Summary Cards — 4 angka di atas:

Card	Arti
High Risk	Jumlah jenis alert HIGH — merah jika > 0
Medium Risk	Jumlah jenis alert MEDIUM
Low Risk	Jumlah jenis alert LOW
Informational	Info/notice, bukan vulnerability

Angka ini adalah jenis alert unik (deduplicated), bukan total kejadian. Contoh: XSS ditemukan di 50 URL = tetap 1 alert type.

Scan Metadata — tabel informasi scan:

Field	Isi
Target	URL yang di-scan
Scan Type	QUICK / STANDARD / FULL
Status	COMPLETED / FAILED
Unique Alert Types	Jumlah jenis vulnerability berbeda
Total Occurrences	Total kejadian di semua URL
Started / Completed	Timestamp UTC
Duration	Durasi scan

Findings Table — tabel utama temuan, dikelompokkan per risk level:

Kolom di tabel:

Kolom	Penjelasan
Risk	HIGH / MEDIUM / LOW / INFORMATIONAL
Confidence	Seberapa yakin ZAP: HIGH / MEDIUM / LOW / FALSE POSITIVE
Alert Name	Nama vulnerability. Di bawahnya: `ref:` (alertRef), `id:` (pluginId), `src:` (sourceId)
Description	Ringkasan 180 karakter pertama
Inst.	Jumlah URL yang terkena vulnerability ini. Klik angka untuk jump ke instances
CWE / WASC	ID klasifikasi standar industri

Navigasi tabel:

Klik baris mana saja → expand detail lengkap di bawahnya
Finding dengan risk HIGH otomatis ter-expand saat halaman pertama dibuka
Group header (bar merah/oranye/kuning) menunjukkan total per risk level

Detail Panel (expand setelah klik baris)

Panel detail terbagi dua kolom:

Kolom kiri:

Field	Isi
Description	Penjelasan lengkap vulnerability — apa yang salah dan kenapa berbahaya
Other Info	Informasi teknis tambahan dari ZAP (contoh: header yang ditemukan, nilai yang mencurigakan)
Solution	Cara memperbaiki vulnerability ini

Kolom kanan:

Field	Isi
Attack Payload	Payload spesifik yang digunakan ZAP saat menemukan vulnerability (dalam code block)
Evidence	String/snippet dari response yang membuktikan vulnerability ada
Classification	Tag CWE, WASC, dan tag ZAP lainnya (chip-chip kecil)
References	Link referensi eksternal (OWASP, CVE, dokumentasi) — bisa diklik

Bagian bawah (full width):

Field	Isi
Affected Instances	Tabel semua URL spesifik dimana vulnerability ini ditemukan

Kolom di tabel instances:

Kolom	Isi
Method	HTTP method (GET/POST/PUT/dll)
URI	URL lengkap yang vulnerable
Parameter	Parameter/field yang dieksploitasi (misal: `id`, `search`, `redirect`)
Attack	Payload spesifik untuk instance ini
Evidence	Response snippet untuk instance ini
Other Info	Info tambahan per instance

Jika instances > 25, muncul tombol ▶ show N more instances untuk load sisanya.

Download Report

Di header/footer halaman report tersedia beberapa opsi unduh:

↓ PDF — download report sebagai PDF profesional (client-side rendering)
Raw ZAP HTML — report HTML asli dari ZAP (lebih verbose)
Raw JSON — data JSON lengkap semua fields dari ZAP
Atau via API: GET /api/reports/<id>/html, /json, /xml

Contoh membaca temuan XSS:

Risk:        HIGH
Confidence:  MEDIUM
Alert Name:  Cross Site Scripting (Reflected)
             ref: 40012-1 · id: 40012

Description: Cross-site Scripting (XSS) adalah serangan injection dimana
             script berbahaya diinjeksi ke dalam website yang dipercaya...

[klik baris untuk expand]

Attack Payload:  "><script>alert(1);</script>
Evidence:        "><script>alert(1);</script>

Solution:        Filter input dengan whitelist, encode output dengan
                 htmlspecialchars(), gunakan Content-Security-Policy header.

Classification:  [CWE-79] [WASC-8] [OWASP_2021_A03]

References:  → https://owasp.org/www-community/attacks/xss/
             → https://cwe.mitre.org/data/definitions/79.html

Affected Instances (3):
  GET  https://example.com/search?q=test          param: q
  GET  https://example.com/products?name=test     param: name
  POST https://example.com/comment                param: body

Download PDF Report

Semua report mendukung download PDF satu klik langsung dari browser — tanpa perlu install apapun di server.

Report yang support PDF:

Report	URL	Format PDF
ZAP Scan Report	`/report/<scan_id>`	Landscape A4 — semua findings di-expand
Full Recon Campaign	`/campaigns/report/<campaign_id>`	Portrait A4 — semua sections di-expand
Individual Tool	`/tools/report/<tool_scan_id>`	Portrait A4

Cara download:

Buka halaman report (klik 👁 di history atau VIEW REPORT setelah campaign selesai)
Klik tombol ↓ PDF di pojok kanan atas header
Tunggu beberapa detik (tombol berubah jadi "⟳ Generating...")
File PDF otomatis terunduh ke Downloads folder

Penamaan file PDF:

zap_report_https_example.com_scan42.pdf        # ZAP report
fullrecon_example.com_campaign7.pdf            # Campaign report
ports_report_example.com.pdf                   # Tool report (port scanner)
ssl_report_example.com.pdf                     # Tool report (SSL analyzer)

Catatan: PDF dirender dari tampilan browser saat itu (dark terminal theme tetap tampil di PDF). Semua section yang collapsed akan di-expand otomatis sebelum rendering agar tidak ada data yang hilang.

AI Analysis

Analisis mendalam hasil ZAP scan menggunakan AI. Saat ini menggunakan Anthropic — dukungan provider lain (OpenAI, Gemini, dll) menyusul.

Requirement: Anthropic API key. Dapatkan di console.anthropic.com.

Cara pakai:

Pastikan ada ZAP scan yang completed
Klik AI ASSIST di navbar
Pilih scan dari dropdown
Pilih mode analisis:

Mode	Untuk	Output
Executive Summary	CTO, non-teknis	3–4 paragraf postur keamanan keseluruhan
Detailed Analysis	Security engineer	Breakdown per vuln, CWE mapping, business impact
Remediation Guide	DevOps, developer	Step-by-step fix, urutan prioritas
Code Examples	Developer	Kode vulnerable vs secure, framework-specific

Klik Generate Analysis
Hasil bisa di-copy dengan tombol Copy

Contoh output Executive Summary:

The security assessment of example.com reveals a moderate risk posture with
3 high-severity and 7 medium-severity findings...

Critical issues requiring immediate attention:
1. SQL Injection vulnerability in /api/users endpoint...
2. Reflected XSS in search parameter...
3. Missing HTTPS enforcement...

Recommended next steps: Patch SQL injection within 24 hours...

Authentication Profiles

Simpan kredensial login terenkripsi untuk reuse di multiple scans.

Cara membuat profile:

Klik AUTH PROFILES di navbar
Klik + New Profile
Isi nama dan pilih metode:

Form-Based Login (paling umum):

Profile Name:   My App - Staging
Auth Type:      Form

Login URL:      https://staging.example.com/auth/login
Username Field: email          ← nama input HTML
Password Field: password       ← nama input HTML
Username:       tester@example.com
Password:       TestPass123!

HTTP Basic Auth:

Profile Name:   Internal API
Auth Type:      Basic

Username:       admin
Password:       secret123

Bearer Token:

Profile Name:   API Token
Auth Type:      Bearer

Token:          eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ...

Cookie-Based:

Profile Name:   Session Cookie
Auth Type:      Cookie

Cookie:         session=abc123def456; csrf_token=xyz789

Save — password dienkripsi dengan Fernet symmetric encryption sebelum disimpan

Menggunakan di Scan:

Di form scan ZAP baru, pilih profile dari dropdown Auth Profile. ZAP akan authenticate dulu sebelum spider mulai crawl.

Contoh Penggunaan Nyata

Skenario 1: Bug Bounty Initial Recon

Target baru masuk program bug bounty. Mulai dengan informasi luas.

1. WHOIS / IP → "Siapa yang host ini? Cloud provider apa?"
2. DNS RECON  → "Ada subdomain apa? SPF/DMARC?"
3. SUBDOMAINS → "Discover semua subdomain"
4. SSL DEEP   → "Sertifikat OK? TLS config?"
5. PORT SCAN  → "Port apa yang terbuka?"
6. API TESTER → "Apa ada misconfiguration mudah?"

Gunakan: Full Recon Campaign → launch semua sekaligus.

Skenario 2: Pentest Web API

Target adalah REST API yang perlu diuji.

1. API TESTER dulu → quick check 18 issues
   - CORS terexpose? Rate limit ada?
   - Header security ada?
   - Backup files ada? (.env, .git?)

2. Jika ada auth → buat Auth Profile dengan Bearer token
3. ZAP Standard Scan dengan auth profile
   - Spider akan crawl dengan auth token
   - Active scan cari XSS, SQLi, IDOR
4. AI Analysis → Detailed Analysis + Remediation Guide

Skenario 3: Security Audit Internal Server

Server internal perusahaan, akses di LAN.

1. PORT SCAN → 192.168.1.x atau 10.0.0.x
   Range: full (semua 65535 port)

2. SSL DEEP → jika ada HTTPS service
   "Sertifikat internal CA? TLS version?"

3. API TESTER → http://internal-app.company.local
   "Ada debug endpoint? Actuator? .env?"

4. ZAP Full Scan (dengan auth)
   "Deep vulnerability scan"

Skenario 4: Verifikasi Perbaikan (Regression Test)

Setelah developer fix vulnerability, verifikasi ulang.

Sebelum fix: ZAP Standard → temuan XSS di /search
Developer fix → deploy ke staging

Verifikasi:
1. ZAP Standard Scan ke staging
2. Cek apakah /search masih flagged
3. AI Analysis → "Apakah perbaikan sudah memadai?"

Bandingkan: scan history bisa dilihat semua di dashboard.

Skenario 5: CTF Web Challenge

Target CTF: http://challenge.ctf.example/

1. API TESTER → cek .env, .git, backup files
   (CTF sering menyembunyikan flag di file-file ini)

2. DNS RECON → cek apakah ada subdomain lain di challenge

3. Port Scanner → port non-standard yang terbuka?

4. ZAP Quick Scan → cek header, XSS dasar

Tool Reference

Severity Levels

Level	Warna	Kapan digunakan
HIGH	`#ff6b6b` merah	Risiko tinggi, exploitable, perlu fix segera
MEDIUM	`#ffaa5a` oranye	Risiko sedang, jadwalkan perbaikan
LOW	`#ffd700` kuning	Risiko rendah, best practice
INFO	`#3a7a5a` hijau tua	Informasi, perlu review konteks
PASS	`#00ffc8` teal	Tidak ada masalah yang ditemukan

Port Risk Matrix

Port	Service	Risk	Alasan
21	FTP	HIGH	Plaintext, anonymous login risk
22	SSH	MEDIUM	Brute-force, key management
23	Telnet	HIGH	Tidak terenkripsi sama sekali
25	SMTP	MEDIUM	Open relay risk
3306	MySQL	HIGH	DB langsung ke internet
5432	PostgreSQL	HIGH	DB langsung ke internet
5900	VNC	HIGH	Remote desktop exposed
6379	Redis	HIGH	No-auth by default
27017	MongoDB	HIGH	No-auth by default
9200	Elasticsearch	HIGH	No-auth, search + data
9300	Elasticsearch	HIGH	Cluster transport
8080	HTTP Alt	MEDIUM	Dev/admin panel
8443	HTTPS Alt	LOW	Alt HTTPS
443	HTTPS	LOW	Normal
80	HTTP	MEDIUM	Unencrypted

API Tester Remediation Quick Reference

Check	Fix Utama
HTTPS + HSTS	`Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
Security Headers	Tambah CSP, X-Frame-Options, X-Content-Type-Options
Server Disclosure	`server_tokens off;` (nginx) / `ServerTokens Prod` (Apache)
WAF	Deploy Cloudflare / AWS WAF / ModSecurity
CORS	Whitelist explicit, jangan reflect arbitrary origin + credentials
Rate Limit	100 req/min per IP, return 429 + Retry-After
API Key Exposure	Pindahkan ke env var server-side, rotasi segera
JWT Weakness	Gunakan RS256, selalu set exp, reject alg=none
GraphQL	`introspection: false` di production
Backup Files	Delete + deny di server config
Admin Panels	Restrict by IP/VPN, enforce MFA
Debug Endpoints	Disable Actuator di prod atau restrict ke internal
PII	Data minimization, masking di response
Credit Card	Hapus semua PAN, gunakan tokenization, PCI-DSS
Internal IP	Custom error pages, proxy hides backend
Stack Trace	Disable debug mode, custom 500 page
SSRF	Whitelist allowed hosts, block RFC-1918, validate URL params

API Reference

Tool Scans

Jalankan tool:

POST /api/tools/run
Content-Type: application/json

{
  "tool": "api",
  "target": "https://example.com",
  "options": {
    "port_range": "top1000"  // hanya untuk tool "ports"
  }
}

Tools valid: ports | dns | subdomains | ssl | whois | api

zap hanya tersedia di campaign, tidak di individual tool run.

Response:

{
  "scan_id": 42,
  "tool": "api",
  "target": "https://example.com",
  "status": "pending"
}

List history:

GET /api/tools/scans

Detail + hasil:

GET /api/tools/scans/{scan_id}

Response saat completed:

{
  "id": 42,
  "tool": "api",
  "target": "https://example.com",
  "status": "completed",
  "progress": 100,
  "result_json": "{\"checks\": [...], \"summary\": {...}}",
  "created_at": "2026-02-25 10:00:00",
  "completed_at": "2026-02-25 10:01:02"
}

Report HTML:

GET /tools/report/{scan_id}

Campaigns

Mulai campaign:

POST /api/campaigns/run
Content-Type: application/json

{
  "target": "https://example.com",
  "tools": ["whois", "dns", "subdomains", "ssl", "ports", "api", "zap"]
}

Tools valid: whois | dns | subdomains | ssl | ports | api | zap

Sertakan "zap" untuk menjalankan OWASP ZAP sebagai tahap terakhir pipeline. ZAP akan otomatis mengkonstruksi URL (https://<target>) jika target tidak dimulai dengan http.

Response:

{
  "campaign_id": 7,
  "target": "https://example.com",
  "tools": ["whois", "dns", "subdomains", "ssl", "ports", "api", "zap"],
  "status": "running"
}

Cek status:

GET /api/campaigns/{campaign_id}/status

Response:

{
  "campaign_id": 7,
  "status": "running",
  "tools": [
    {"tool": "whois", "status": "completed", "progress": 100, "scan_id": 38},
    {"tool": "dns",   "status": "completed", "progress": 100, "scan_id": 39},
    {"tool": "ports", "status": "running",   "progress": 45,  "scan_id": 40},
    {"tool": "api",   "status": "pending",   "progress": 0,   "scan_id": null}
  ]
}

Report HTML:

GET /campaign/report/{campaign_id}

ZAP Scans

Mulai scan:

POST /api/scans
Content-Type: application/json

{
  "target_url": "https://example.com",
  "scan_type": "quick",
  "auth_profile_id": null
}

scan_type: quick | standard | full

List scans:

GET /api/scans

Detail scan:

GET /api/scans/{scan_id}

Abort scan:

POST /api/scans/{scan_id}/abort

Report:

GET /report/{scan_id}                    # HTML dark terminal report
GET /api/reports/{scan_id}/html          # Raw ZAP HTML (download)
GET /api/reports/{scan_id}/json          # Raw ZAP JSON (download)
GET /api/reports/{scan_id}/xml           # Raw ZAP XML (download)

Auth Profiles

List:

GET /api/auth-profiles

Buat:

POST /api/auth-profiles
Content-Type: application/json

{
  "name": "Staging Login",
  "auth_type": "form",
  "config": {
    "login_url": "https://staging.example.com/login",
    "username_field": "email",
    "password_field": "password",
    "username": "test@example.com",
    "password": "TestPass123!"
  }
}

auth_type: form | basic | bearer | cookie

Hapus:

DELETE /api/auth-profiles/{id}

Test:

POST /api/auth-profiles/{id}/test

System

Stats dashboard:

GET /api/stats

Log stream:

GET /api/logs?since={last_log_id}&limit=50

Resources:

GET /api/system/resources

Response:

{
  "cpu_percent": 23.5,
  "ram_percent": 61.2,
  "can_run_parallel": true
}

Set API key:

POST /api/settings/anthropic-key
Content-Type: application/json

{ "api_key": "sk-ant-api03-..." }

Status API key:

GET /api/settings/anthropic-key

Konfigurasi

Environment Variables

Variable	Default	Keterangan
`ANTHROPIC_API_KEY`	—	API key untuk AI analysis
`FLASK_ENV`	`production`	`production` / `development`
`_JAVA_OPTIONS`	`-Xmx2g`	Heap size JVM untuk ZAP. Naikkan ke `-Xmx4g` jika RAM ≥ 8GB

File `.env`

cp .env.example .env
# Edit .env:
ANTHROPIC_API_KEY=sk-ant-api03-...

Docker Compose otomatis baca .env di direktori yang sama.

Tuning ZAP Memory

Untuk target besar atau Full scan, naikkan heap:

# Di .env atau export
_JAVA_OPTIONS=-Xmx4g   # jika RAM 8GB+
_JAVA_OPTIONS=-Xmx6g   # jika RAM 16GB+

Database Backup

# Backup
cp data/mari_scanner.db data/backup-$(date +%Y%m%d).db

# Restore
cp data/backup-20260225.db data/mari_scanner.db
docker compose restart

Troubleshooting

Dashboard tidak bisa diakses

docker compose ps              # cek container running?
docker compose logs --tail=50  # lihat error
lsof -i :5001                  # cek port conflict

Ganti port di docker-compose.yml:

ports:
  - "5002:5000"   # ganti 5001 ke port lain

Scan stuck "running" setelah restart

Normal. Saat restart, init_db() otomatis set semua pending/running scan ke failed. Ini mencegah zombie scans yang tidak bisa selesai karena ZAP session terputus.

ZAP di Campaign selalu FAILED / "ZAP scan failed"

Penyebab paling umum:

ZAP daemon tidak terinstall atau tidak ada di /opt/zap/zap.sh
Target hanya berupa domain (misal example.com) tanpa HTTPS aktif — ZAP akan coba https://example.com dulu, jika gagal akan error. Gunakan target yang full URL jika perlu HTTP: http://example.com
ZAP membutuhkan waktu startup ~30–60 detik; jika semua tool recon selesai sangat cepat, ZAP mungkin belum ready

Campaign akan tetap selesai dengan status partial jika ZAP gagal — tools lain yang berhasil tetap tersimpan.

ZAP gagal start / scan selalu failed

# Cek ZAP process
docker exec mari-pentest-tools ps aux | grep zap

# Lihat error
docker compose logs | grep -iE "zap|error|java|oom"

Penyebab umum:

Java memory kurang: Docker Desktop → Preferences → Resources → naikan RAM ke 4GB+
Build gagal: Jalankan docker compose build --no-cache

Database tidak persist setelah restart

# Pastikan direktori data ada SEBELUM start
mkdir -p data
docker compose up -d

Docker tidak bisa buat parent directory otomatis dari volume mount.

AI Analysis gagal

# Cek env variable
docker compose exec mari-pentest-tools env | grep ANTHROPIC

# Test koneksi ke API
docker compose exec mari-pentest-tools \
  curl -s https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model":"<model-id>","max_tokens":10,"messages":[{"role":"user","content":"hi"}]}'

Port Scanner sangat lambat

Normal untuk target di luar LAN yang firewall-nya drop packets (bukan reject). Setiap port nunggu timeout 1 detik. Untuk top1000, worst case ~17 menit jika semua di-drop.

Gunakan top100 untuk quick check.

Build gagal — ZAP download timeout

# Build dengan progress visible
DOCKER_BUILDKIT=1 docker compose build --no-cache --progress=plain

# Coba ulang (GitHub sometimes rate-limit)
docker compose build

Security Notice

Tool ini hanya untuk penggunaan yang sah dan terotorisasi.

Hanya scan target yang Anda miliki atau yang telah memberikan izin tertulis eksplisit
Scanning tanpa izin adalah ilegal di sebagian besar yurisdiksi, termasuk Indonesia (UU ITE Pasal 30)
Jangan ekspos dashboard ke internet tanpa proteksi tambahan (nginx basic auth, VPN, IP whitelist)
File data/mari_scanner.db menyimpan hasil scan dan credential profiles — jaga keamanannya
Gunakan credential test, jangan credential production

Legal use cases: CTF, bug bounty (dalam scope), authorized pentest, internal security audit, security research dengan izin.

Changelog

v4.1 — ZAP Campaign Integration + PDF Export (Feb 2026)

Ditambahkan:

ZAP di Full Recon Campaign — OWASP ZAP kini bisa dijalankan sebagai tahap opsional di campaign pipeline (WEB VULN (ZAP) checkbox, opt-in). Progress di-mirror real-time ke pipeline view
CampaignZAPScanner — adapter class yang menjembatani SecurityScanner (tabel scans) dengan interface campaign tool (tabel tool_scans), termasuk deduplication alerts
ZAP section di Campaign Report — section baru "WEB VULN SCAN (ZAP)" dengan alert count mini-grid, tabel findings per risk level, dan link ke full ZAP report
ZAP card di Executive Summary — scorecard di campaign report kini 6 card (termasuk Web Vulns)
PDF Download — tombol ↓ PDF di semua 3 jenis report (ZAP, Campaign, Tool) menggunakan html2pdf.js client-side, tanpa dependency server

Diperbarui:

TOOL_MAP + RECON_ORDER sekarang include zap (urutan terakhir)
campaign_report() route ekstrak dan group ZAP alerts per risk level sebelum pass ke template
Semua template report mendapat @media print CSS yang disempurnakan
Full Recon modal di dashboard: tambah checkbox ZAP dengan estimasi waktu
CAMPAIGN_TOOL_LABELS di main.js: tambah label untuk zap
API /api/campaigns/run kini menerima "zap" dalam array tools

v4.0 — Swiss Army Knife + Campaign Mode (Feb 2026)

Ditambahkan:

API Security Tester — 18 automated checks lengkap
Full Recon Campaign — pipeline otomatis semua tools
Campaign Report — executive summary scorecard
Port Scanner dengan service detection
DNS Recon + email security analysis
Subdomain Enumerator + takeover detection
SSL Deep Analyzer
WHOIS + IP Intel + cloud provider detection
Console easter egg (Mariworks ASCII art + hacker quotes)
Terminal SVG favicon

Diperbaiki:

toolIcon map include semua 6 tools
API Tester enabled by default di campaign checklist
RECON_ORDER include api

v3.0 — Dark Terminal Edition

UI overhaul lengkap: flat TUI, Fira Code monospace
Custom report dark teal theme, full-width, semua ZAP fields
Live terminal log panel + system resources monitor
Fix: DB volume mount, report generation, UTC timestamps
Fix: ZAP 2.17.0, port 5001/8081 (AirPlay conflict)
Fix: debug=False di production, zombie scan cleanup
AI provider: Anthropic

v2.0 — Dark Console Edition

AI analysis integration (Anthropic)
Multiple auth profile support + encrypted storage
Docker-first deployment
Scan types: Quick / Standard / Full

v1.0 — Initial Release

OWASP ZAP integration
Form/Basic/Bearer/Cookie auth
Real-time progress + scan queue
SQLite + HTML/JSON/XML export

Struktur File

mari-pentest-tools/
├── app.py                     # Flask app + semua tool classes
│   ├── SecurityScanner        # OWASP ZAP wrapper (spider + active scan)
│   ├── PortScanner            # TCP port scanner
│   ├── DNSRecon               # DNS record enumeration
│   ├── SubdomainEnumerator    # Brute-force + takeover detection
│   ├── SSLAnalyzer            # TLS/cert analyzer
│   ├── WHOISLookup            # WHOIS + IP intel
│   ├── APISecurityTester      # 18 security checks
│   ├── CampaignZAPScanner     # Adapter: ZAP dalam campaign pipeline
│   ├── run_campaign()         # Campaign orchestrator (7 tools incl. ZAP)
│   └── Flask routes           # ~30 API endpoints
│
├── templates/
│   ├── index.html             # Dashboard UI (dark terminal TUI)
│   ├── report.html            # ZAP scan report
│   ├── tool_report.html       # Swiss Army tool report
│   └── campaign_report.html   # Full Recon Campaign report
│
├── static/
│   ├── css/                   # Tailwind output
│   ├── js/main.js             # Frontend (~1200 lines vanilla JS)
│   └── favicon.svg            # Terminal icon
│
├── data/
│   └── mari_scanner.db        # SQLite (Docker volume)
│
├── reports/                   # ZAP raw reports (Docker volume)
│
├── requirements.txt
├── Dockerfile
├── docker-compose.yml
├── run.sh / stop.sh / restart.sh / logs.sh
└── .env.example

Powered by Mariworks · Built on OWASP ZAP

File: mari-pentest/CHANGELOG.md

Changelog - Mari Pentest Tools

[2.0.0] - 2025-02-24 - Dark Console Edition

🎨 Major UI Overhaul

Dark Terminal Theme - Complete redesign with hacker-inspired green/black console aesthetic
Terminal Effects - Scanline overlay, glowing text, and matrix-style animations
Custom Fonts - Fira Code monospace for authentic terminal look
Responsive Cards - Hover effects and smooth transitions
Progress Bars - Glowing green progress indicators with real-time updates

🤖 AI Integration (NEW!)

Advanced AI Model - Integrated intelligent analysis capabilities
Executive Summary - AI-generated C-level security reports
Detailed Analysis - Technical vulnerability breakdowns with CWE mappings
Remediation Guide - Step-by-step fix instructions prioritized by risk
Code Examples - Secure vs vulnerable code patterns
Smart Recommendations - Context-aware security advice
AI Assistant Modal - Dedicated interface for AI-powered analysis

🔐 Enhanced Features

AI Button in Navbar - Quick access to AI analysis
Per-Scan AI Analysis - Brain icon on each completed scan
Copy AI Response - One-click copy to clipboard
Markdown Formatting - Properly formatted AI responses with syntax highlighting
Loading States - Visual feedback during AI processing

🎯 Improvements

Better Badge Styling - Terminal-themed alert badges (HIGH/MED/LOW)
Enhanced Icons - More intuitive action icons
Improved Spacing - Better visual hierarchy
Notification System - Terminal-styled toast notifications
Modal Animations - Smooth backdrop blur effects

📝 Documentation

Updated README - Complete rewrite with AI features
Environment Config - .env.example for API key setup
Quick Start Guide - AI workflow included
Changelog - This file!

🐛 Bug Fixes

Fixed modal z-index issues
Improved mobile responsiveness
Better error handling for AI requests
Database connection pooling

🔧 Technical Changes

Upgraded branding to "Mari Pentest Tools"
Added Anthropic API integration
Enhanced Flask backend with AI endpoint
Improved JavaScript organization
Better CSS architecture with custom properties

[1.0.0] - 2025-02-23 - Initial Release

Core Features

Advanced security scanner integration
Form-based authentication
HTTP Basic/Bearer auth support
Real-time scan progress
Multiple report formats (HTML/JSON/XML)
Saved auth profiles
Docker support
SQLite database
Responsive web UI

Authentication

Form-based login support
HTTP Basic Auth
Bearer Token/API keys
Cookie management
Encrypted credential storage

Scanning

Quick scan mode (5-10 min)
Standard scan mode (15-30 min)
Full scan mode (1-2 hours)
Spider + Active scan
Progress tracking
Queue management

Upgrade Path

From 1.0 to 2.0

Docker users:

# Pull latest
git pull  # or download new release
docker-compose down
docker-compose build
export ANTHROPIC_API_KEY="your-key"
docker-compose up -d

Manual users:

# Update files
git pull  # or replace files

# Install requirements (if changed)
pip3 install -r requirements.txt --break-system-packages

# Set API key
export ANTHROPIC_API_KEY="your-key"

# Restart
python3 app.py

Database Migration: No database changes - fully backward compatible!

Coming Soon (v2.1)

Note: Version 2.0 requires an API key for AI features. All other features work without it.

Get your API key: https://console.anthropic.com

File: mari-pentest/DOCKER-QUICKSTART.md

⚡ Mari Pentest Tools - Zero-Install Quick Start

Just Docker. Nothing else.

🚀 3-Step Installation (Any OS)

1️⃣ Install Docker

macOS:

brew install --cask docker

Or download: https://www.docker.com/products/docker-desktop

Linux:

curl -fsSL https://get.docker.com | sh

Windows: Download: https://www.docker.com/products/docker-desktop

2️⃣ Extract & Run

tar -xzf mari-pentest-tools.tar.gz
cd mari-pentest-tools

# Option A: Use starter script (auto-fixes permissions)
bash start.sh

# Option B: Fix permissions manually then run
chmod +x *.sh
./run.sh

That's it! 🎉

3️⃣ Open Browser

http://localhost:5000

🤖 Enable AI (Optional)

# Get API key from: https://console.anthropic.com
export ANTHROPIC_API_KEY="sk-ant-your-key"
./run.sh

📋 Quick Commands

Command	Action
`./run.sh`	Start the tool
`./stop.sh`	Stop the tool
`./logs.sh`	View logs
`./restart.sh`	Restart services

✅ What Gets Installed?

On your machine:

Nothing! (except Docker)

Inside Docker:

Python, Java, Security Scanner
Web server, Database
All dependencies
Everything isolated

🎯 First Scan

Open http://localhost:5000
Click NEW SCAN
Enter URL: https://example.com
Select: STANDARD
Click EXECUTE
Wait 15-30 min
View results! 🎉

💡 Why Docker-Only?

✅ Zero Config - No dependency hell ✅ Cross-Platform - Same setup everywhere ✅ Clean - Doesn't touch your system ✅ Portable - Move between machines ✅ Updatable - docker-compose pull

🔧 Advanced (Optional)

Custom Port

# Edit docker-compose.yml
ports:
  - "8080:5000"  # Use port 8080 instead

Persistent Data

# Data auto-saved in:
./reports/          # Scan reports
./mari_scanner.db   # Database

Update

./stop.sh
docker-compose pull
./run.sh

🆘 Troubleshooting

Permission denied error:

# Error: zsh: permission denied: ./run.sh

# Fix:
chmod +x *.sh
./run.sh

# Or just use:
bash start.sh  # This auto-fixes permissions

Port already in use:

# Change port in docker-compose.yml
ports:
  - "8888:5000"  # Use different port

Container won't start:

./logs.sh  # Check logs
docker ps  # Check status

Reset everything:

./stop.sh
docker-compose down -v
bash start.sh

🎓 Full Documentation

See README.md for:

Manual installation (without Docker)
Authentication setup
AI analysis features
VPS deployment
Advanced configuration

That's all you need! 🚀

No Python, no Java, no dependencies - just Docker and go!

File: mari-pentest/QUICK-START.md

⚡ Mari Pentest Tools - Quick Start Guide

Dark Console Edition v2.0 - AI-Powered Security Scanner

✨ Recommended: Docker-Only Setup (Zero Install)

🚀 Fastest Start - Docker Only

Requirements: Docker (that's it!)

# Extract
tar -xzf mari-pentest-tools.tar.gz
cd mari-pentest-tools

# Run (auto-fixes permissions and starts)
bash install.sh

# OR fix permissions manually:
chmod +x *.sh
./run.sh

# Open: http://localhost:5000

Enable AI (optional):

export ANTHROPIC_API_KEY="sk-ant-xxxxx"
bash start.sh

Commands:

bash start.sh - First time / permission fix
./run.sh - Start (after permissions fixed)
./stop.sh - Stop
./logs.sh - View logs
./restart.sh - Restart

Done! No Python, Java, or dependencies needed. ✅

📦 Install Docker (One-Time)

macOS:

brew install --cask docker

Linux:

curl -fsSL https://get.docker.com | sh

Windows: Download: https://docker.c

*Truncated - read the full file at https://github.com/firebitsbr/Writeups-claudeskills/blob/db01f8ea1415b822a763707e8e902e97174420fb/claudeskills/writeup

About

name: writeup-fiantinangon description: CTF writeups and security challenges by fiantinangon.

Writeups by fiantinangon

Repository Index

Writeup Content

File: mari-pentest/README.md

Mari Pentest Tools

Daftar Isi

Fitur

Swiss Army Knife — 6 Built-in Security Tools

Full Recon Campaign

OWASP ZAP Integration

PDF Download

AI Analysis

Arsitektur

Instalasi

Docker (Recommended)

One-liner

Manual

Helper Scripts

Set API Key via Dashboard (tanpa restart)

macOS Native (Tanpa Docker)

Linux Native

Tutorial Lengkap

Swiss Army Knife Tools

Port Scanner

DNS Recon

Subdomain Enumeration

SSL Deep Analyzer

WHOIS / IP Intel

API Security Tester

Full Recon Campaign

OWASP ZAP Scanner

Cara Menjalankan Scan

ZAP Scan vs Swiss Army Tools

Memahami Hasil Scan — Dashboard

Memahami Scan Report (/report/<id>)

Download PDF Report

AI Analysis

Authentication Profiles

Contoh Penggunaan Nyata

Skenario 1: Bug Bounty Initial Recon

Skenario 2: Pentest Web API

Skenario 3: Security Audit Internal Server

Skenario 4: Verifikasi Perbaikan (Regression Test)

Skenario 5: CTF Web Challenge

Tool Reference

Severity Levels

Port Risk Matrix

API Tester Remediation Quick Reference

API Reference

Tool Scans

Campaigns

ZAP Scans

Auth Profiles

System

Konfigurasi

Environment Variables

File .env

Tuning ZAP Memory

Database Backup

Troubleshooting

Dashboard tidak bisa diakses

Scan stuck "running" setelah restart

ZAP di Campaign selalu FAILED / "ZAP scan failed"

ZAP gagal start / scan selalu failed

Database tidak persist setelah restart

AI Analysis gagal

Port Scanner sangat lambat

Build gagal — ZAP download timeout

Security Notice

Changelog

v4.1 — ZAP Campaign Integration + PDF Export (Feb 2026)

v4.0 — Swiss Army Knife + Campaign Mode (Feb 2026)

v3.0 — Dark Terminal Edition

v2.0 — Dark Console Edition

v1.0 — Initial Release

Struktur File

File: mari-pentest/CHANGELOG.md

Changelog - Mari Pentest Tools

Memahami Scan Report (`/report/<id>`)

File `.env`