Penetration Testing for Cross-Site Scripting (XSS) Detection Using Penetration Testing Execution Standard (PTES) Methodology: A Case Study of Information Systems in Institution X - Nabila Aulia Azizah; Gede Arna Jude Saskara; Gede Saindra Santyadiputra (KARMAPATI (Kumpulan Artikel Mahasiswa Pendidikan Teknik Informatika), 2026)
Web-based information systems in educational institutions store and process sensitive data, turning them into a perfect target for cybercriminals, particularly Cross-Site Scripting (XSS). This research aims to identify and evaluate XSS vulnerabilities across twelve web-based information systems at Institution X using Penetration Testing Execution Standard (PTES) methodology, combined with grey-box technique and black-box technique, and OWASP Risk Rating Methodology to assess the risk of the vulnerabilities. The testing was conducted by the researcher as an insider tester with student-level access, applying black-box testing for systems inaccessible to students and grey-box testing for systems accessible to students. The combination of automated tools including passive reconnaissance, active reconnaissance and manual testing was employed to minimize false positive and validated the vulnerabilities. The total of eleven XSS vulnerabilities across the twelve tested systems, consist of five Reflected XSS and six Stored XSS. No DOM-Based XSS vulnerabilities were confirmed across all the tested systems. All of identified vulnerabilities were assessed as medium risk based on the OWASP Risk Rating Methodology. These findings demonstrate that XSS vulnerabilities are still present within the educational institution environment indicates that secure input handling was inconsistently implemented across systems. The result highlights the importance of adopting remediation to secure coding practices, implementing proper input sanitization, output encoding, securing HTTP Headers, and Content Security Policy (CSP), as well as conducting regular security assessment to strengthen the overall security posture in an information system within educational institution.