<![CDATA[SIMPELMAS was a web-based information system used by the LP2M of XYZ University to manage research and community service data. A hacking incident on the simpelmas.universitas-xyz.ac.id subdomain indicated security vulnerabilities that needed further investigation. This research aimed to analyse the vulnerability level of the subdomain using a penetration testing approach based on the Open Web Application Security Project (OWASP) Top 10 2021 edition standards. A black-box testing method was implemented through data collection, vulnerability scanning, exploitation testing, and report preparation stages, utilising OWASP ZAP, Burp Suite, and SQLMap tools. The results revealed two principal vulnerabilities: Security Misconfiguration in the form of active APP_DEBUG on the production server, and Identification and Authentication Failures due to the absence of login attempt restrictions (rate limiting). This research provides technical recommendations for mitigation and can serve as a reference for security improvements in similar information systems within academic environments.SIMPELMAS adalah sistem informasi berbasis web yang digunakan LP2MUniversitas XYZ untuk pengelolaan data penelitian dan pengabdian masyarakat. Insiden peretasan pada subdomain simpelmas.universitas-xyz.ac.id mengindikasikan adanya celah keamanan yang perlu diteliti. Penelitian ini menganalisis kerentanan subdomain tersebut menggunakan pendekatan penetration testing berdasarkan standar OWASP Top 10 edisi 2021. Metode blackbox testing diterapkan melalui tahapan pengumpulan data, pemindaian kerentanan, pengujian eksploitasi, dan penyusunan laporan dengan memanfaatkan tools OWASP ZAP, Burp Suite, dan SQLMap. Hasil penelitian menemukan dua kerentanan utama: Security Misconfiguration berupa aktifnya APP_DEBUG di server produksi dan Identification and Authentication Failures karena tidak adanya pembatasan percobaan login. Penelitian ini menyediakan rekomendasi teknis untuk mitigasi dan dapat menjadi rujukan perbaikan keamanan sistem informasi di lingkungan akademik.]]>
