UNDERGROUND - YUDHAX: Training

Tampilkan postingan dengan label Training. Tampilkan semua postingan

Sabtu, 25 Oktober 2025

WEB APP PENTESTING CHECKLIST

 Phase 1: Reconnaissance & Information Gathering 🕵️‍♂️
Identify the target domain and IP addresses 🌐
Enumerate subdomains 🔍
Check for DNS records (A, MX, CNAME, TXT) 📋
Perform WHOIS lookup for domain registration details 📞
Identify technologies used (frameworks, libraries, CMS) 🛠️
Check SSL/TLS certificate details 🔒
Map the application architecture (frontend/backend/APIs) 🏗️
Identify entry points (login forms, APIs, file uploads) 🚪
Review robots.txt and sitemap.xml files 🤖
Look for exposed directories/files using directory brute-forcing 📂
Check for open ports and services 🚪
Identify third-party integrations (payment gateways, analytics) 🤝
Analyze HTTP headers for security configurations 📑
Check for error messages leaking sensitive information ❌
Review version control files (.git, .svn) 📁
Identify backup files or archives (.bak, .zip) 💾
Check for default credentials in documentation 📚
Identify any hardcoded secrets in client-side code 🔑
Analyze cookies for sensitive data 🍪
Map user roles and permissions 🧑‍💼
— 
Phase 2: OWASP Top Ten Categories and Subcategories 🛡️
Broken Access Control 🔓
Test for unauthorized access to admin pages 🚫
Verify role-based access controls 🧑‍💻
Check for IDOR (Insecure Direct Object References) 🆔
Test for privilege escalation vulnerabilities ⬆️
Verify proper session management 🔑
Check for missing authorization checks on API endpoints 📡
Test for bypassing CAPTCHA mechanisms 🤖
Verify access to restricted files or resources 📂
Test for improper logout functionality 🚪
Check for insecure redirects or forwards ➡️
Cryptographic Failures 🔐
Check for weak encryption algorithms 🛠️
Verify secure storage of sensitive data 🔒
Test for plaintext transmission of sensitive data 📡
Check for improper certificate validation 🔐
Verify HTTPS usage across all pages 🌐
Test for weak password hashing mechanisms 🔑
Check for exposure of sensitive tokens or keys 🔑
Verify secure random number generation 🎲
Test for improper handling of cryptographic exceptions ❌
Check for insecure use of JWTs (JSON Web Tokens) 📜
Injection Flaws 💉
Test for SQL injection vulnerabilities 🗄️
Check for NoSQL injection vulnerabilities 📊
Verify input sanitization for OS commands ⌨️
Test for LDAP injection vulnerabilities 📋
Check for XSS (Cross-Site Scripting) vulnerabilities 🌐
Verify protection against template injection 📝
Test for command injection vulnerabilities 💻
Check for XPath injection vulnerabilities 📊
Verify protection against header injection 📑
Test for log injection vulnerabilities 📜
Insecure Design 🏗️
Review the application’s threat model 🛡️
Check for lack of security controls in design 🚫
Verify adherence to secure coding practices 🛠️
Test for improper error handling mechanisms ❌
Check for insecure default configurations ⚙️
Verify proper input validation throughout the app 📋
Test for insufficient logging and monitoring 📊
Check for insecure use of third-party components 🤝
Verify secure integration with external systems 🌐
Test for inadequate data validation flows 🔄
Security Misconfiguration ⚙️
Check for unnecessary features enabled 🚫
Verify proper configuration of security headers 📑
Test for default accounts/passwords 🧑‍💻
Check for verbose error messages ❌
Verify proper file permissions 📂
Test for insecure cloud storage configurations ☁️
Check for outdated software versions 🔄
Verify secure database configurations 🗄️
Test for improper CORS policies 🌐
Check for missing security patches 🛠️
Vulnerable Components 🧩
Identify outdated libraries/frameworks 🔄
Check for known vulnerabilities in dependencies 🔍
Verify dependency updates are applied regularly 🛠️
Test for insecure use of open-source components 🌟
Check for unused or redundant components 🚫
Verify secure integration of third-party APIs 🌐
Test for insecure plugin/module usage 🧩
Check for unpatched vulnerabilities in components 🛡️
Verify secure handling of component updates 🔄
Test for insecure use of custom-built components 🛠️
Identification and Authentication Failures 🔑
Check for weak password policies 🧑‍💻
Verify multi-factor authentication (MFA) implementation 🔒
Test for account enumeration vulnerabilities 🆔
Check for insecure password recovery mechanisms 🔄
Verify session timeout and invalidation 🔑
Test for brute-force attack protections 🛡️
Check for insecure storage of credentials 🔒
Verify secure handling of authentication tokens 📜
Test for improper use of remember-me functionality 🧠
Check for insecure OAuth implementations 🌐
Software and Data Integrity Failures 🔄
Verify integrity of downloaded files/updates 📥
Check for insecure deserialization vulnerabilities 🧩
Test for tampering of client-side data 🔄
Verify secure handling of serialized objects 📦
Check for improper validation of external inputs 📋
Test for insecure use of auto-update mechanisms 🔄
Verify secure handling of backups 💾
Check for improper validation of digital signatures 📜
Test for insecure handling of API responses 📡
Verify secure deployment pipelines 🛠️
Security Logging and Monitoring Failures 📊
Check for insufficient logging of security events 📜
Verify proper alerting mechanisms for anomalies ⚠️
Test for logging of sensitive data 🔒
Check for centralized logging solutions 📊
Verify log retention policies 📅
Test for real-time monitoring capabilities 🕒
Check for correlation of logs across systems 🔄
Verify secure storage of logs 🔒
Test for detection of brute-force attacks 🛡️
Check for logging of failed login attempts 🔑

Server-Side Request Forgery (SSRF) 🌐
Test for SSRF vulnerabilities in APIs 📡
Check for improper validation of URLs 🌐
Verify protection against internal network access 🛡️
Test for SSRF via metadata endpoints ☁️
Check for improper handling of redirects ➡️
Verify secure parsing of user-supplied URLs 📑
Test for SSRF in image/file processing 🖼️
Check for SSRF in email sending functionality 📧
Verify secure handling of proxy configurations 🌐
Test for SSRF in third-party integrations 🤝
— -
Phase 3: Advanced Vulnerabilities 🚀
Advanced Injection Techniques
Test for blind SQL injection vulnerabilities 🗄️
Check for second-order SQL injection vulnerabilities ⚡
Test for time-based blind SQL injection ⏳
Verify protection against union-based SQL injection 🛡️
Test for stacked queries in SQL injection 📜
Check for out-of-band SQL injection vulnerabilities 🌐
Test for advanced NoSQL injection techniques 📊
Verify protection against GraphQL query injection 📊
Test for server-side template injection (SSTI) 📝
Check for advanced XSS payloads (DOM-based, stored, reflected) 🌐
Advanced Authentication Attacks
Test for token replay attacks 🔑
Check for JWT none algorithm vulnerabilities 📜
Test for JWT signature verification bypass 🛡️
Verify protection against OAuth CSRF attacks 🌐
Test for session fixation vulnerabilities 🔑
Check for improper session regeneration after login 🔄
Test for insecure password reset mechanisms 🔄
Verify protection against credential stuffing attacks 🛡️
Test for insecure single sign-on (SSO) implementations 🌐
Check for improper handling of OAuth scopes 📑
Advanced Authorization Attacks
Test for horizontal privilege escalation ⬆️
Check for vertical privilege escalation 🧑‍💻
Test for bypassing access controls via API endpoints 📡
Verify protection against forced browsing attacks 📂
Test for bypassing CAPTCHA during critical workflows 🤖
Check for improper handling of user roles in APIs 📡
Test for bypassing two-factor authentication (2FA) 🔒
Verify protection against business logic flaws in authorization 🔄
Test for bypassing rate limits in sensitive operations ⏳
Check for improper handling of permissions in microservices 🌐
Advanced Business Logic Flaws
Test for improper price manipulation in e-commerce apps 💰
Check for bypassing payment steps 🛒
Verify secure handling of referral bonuses 🎁
Test for abuse of discount codes 🛍️
Check for improper inventory management 📦
Verify secure handling of workflows 🔄
Test for abuse of rate limits ⏳
Check for improper access to hidden features 🔍
Verify secure handling of cancellation flows 🚫
Test for abuse of free trials 🕒
Advanced Miscellaneous Vulnerabilities
Test for insecure WebSocket implementations 🌐
Check for improper handling of CORS preflight requests 📡
Verify protection against clickjacking attacks 🖱️
Test for insecure handling of HTTP headers 📑
Check for improper handling of JSONP callbacks 📜
Verify protection against host header injection attacks 🌐
Test for insecure use of Web Assembly (WASM) 🛠️
Check for improper handling of CSP (Content Security Policy) 🛡️
Verify protection against XML External Entity (XXE) attacks 📊
Test for insecure handling of file uploads (e.g., RCE via uploads) 📂
— -
Phase 4: Report Writing ✍️
Include an executive summary 📑
Provide a detailed methodology section 🛠️
List all identified vulnerabilities 🛡️
Include risk ratings for each issue ⚠️
Add screenshots for clarity 📷
Provide step-by-step reproduction steps 🔄
Include remediation recommendations 🛠️
Highlight critical findings first 🔥
Add references to OWASP guidelines 📚
Include a timeline of testing activities 📅
Provide a glossary of technical terms 📖
Include a disclaimer for limitations 🚫
Add contact information for follow-up 📞
Verify confidentiality of the report 🔒
Proofread for grammar and clarity ✍️
Format the report professionally 📄
Include a table of contents 📑
Add appendices for additional details 📋
Verify alignment with client requirements 🤝
Include a conclusion with next steps 🚀
— -
Phase 5: Final Steps 🏁
Re-test after fixes are applied 🔄
Verify patch effectiveness 🛡️
Document lessons learned 📚
Update the threat model 🏗️
Conduct a post-mortem analysis 📊
Share findings with stakeholders 🤝
Provide training for developers 🛠️
Recommend periodic security audits 📅
Encourage a security-first mindset 🛡️
Celebrate successes 🎉
— 
This checklist provides detailed steps to find web application flaws in 2025 this checklist is for those who are looking to start career in bug bounty or web app security - medium

Rabu, 16 Mei 2012

How to Load balancing Mikrotik - NTH mode

Introduction

This example is improved (different) version of round-robin load balancing example. It adds persistent user sessions, i.e. a particular user would use the same source IP address for all outgoing connections. Consider the following network layout:

Quick Start for Impatient

Configuration export from the gateway router:

/ ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local 
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1

/ ip firewall mangle
add chain=prerouting src-address-list=odd in-interface=Local action=mark-connection \
  new-connection-mark=odd passthrough=yes 
add chain=prerouting src-address-list=odd in-interface=Local action=mark-routing \
  new-routing-mark=odd passthrough=no
add chain=prerouting src-address-list=even in-interface=Local action=mark-connection \
  new-connection-mark=even passthrough=yes 
add chain=prerouting src-address-list=even in-interface=Local action=mark-routing \
  new-routing-mark=even passthrough=no
add chain=prerouting in-interface=Local connection-state=new nth=2,1 \ 
    action=mark-connection new-connection-mark=odd passthrough=yes
add chain=prerouting in-interface=Local action=add-src-to-address-list \
  address-list=odd address-list-timeout=1d connection-mark=odd passthrough=yes 
add chain=prerouting in-interface=Local connection-mark=odd action=mark-routing \ 
    new-routing-mark=odd passthrough=no
add chain=prerouting in-interface=Local connection-state=new nth=2,2 \ 
    action=mark-connection new-connection-mark=even passthrough=yes
add chain=prerouting in-interface=Local action=add-src-to-address-list \
  address-list=even address-list-timeout=1d connection-mark=even passthrough=yes 
add chain=prerouting in-interface=Local connection-mark=even action=mark-routing \ 
    new-routing-mark=even passthrough=no

/ ip firewall nat 
add chain=srcnat out-interface=wlan1 action=masquerade
add chain=srcnat out-interface=wlan2 action=masquerade

/ ip route 
add dst-address=0.0.0.0/0 gateway=10.111.0.1 scope=255 target-scope=10 routing-mark=odd
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 routing-mark=even 
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10

Explanation

First we give a code snippet and then explain what it actually does.

IP Addresses

/ ip address 
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2 
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1

The router has two upstream (WAN) interfaces with the addresses of 10.111.0.2/24 and 10.112.0.2/24. The LAN interface has the name "Local" and IP address of 192.168.0.1/24.

Mangle

/ ip firewall mangle 
add chain=prerouting src-address-list=odd in-interface=Local action=mark-connection \
  new-connection-mark=odd passthrough=yes 
add chain=prerouting src-address-list=odd in-interface=Local action=mark-routing \
  new-routing-mark=odd

All traffic from customers having their IP address previously placed in the address list "odd" is instantly marked with connection and routing marks "odd". Afterwards the traffic is excluded from processing against successive mangle rules in prerouting chain.

/ ip firewall mangle 
add chain=prerouting src-address-list=even in-interface=Local action=mark-connection \
  new-connection-mark=even passthrough=yes 
add chain=prerouting src-address-list=even in-interface=Local action=mark-routing \
  new-routing-mark=even

Same stuff as above, only for customers having their IP address previously placed in the address list "even".

/ ip firewall mangle 
add chain=prerouting in-interface=Local connection-state=new nth=2,1 \ 
    action=mark-connection new-connection-mark=odd passthrough=yes
add chain=prerouting in-interface=Local action=add-src-to-address-list \
  address-list=odd address-list-timeout=1d connection-mark=odd passthrough=yes 
add chain=prerouting in-interface=Local connection-mark=odd action=mark-routing \ 
    new-routing-mark=odd passthrough=no

First we take every second packet that establishes new session (note connection-state=new), and mark it with connection mark "odd". Consequently all successive packets belonging to the same session will carry the connection mark "odd". Note that we are passing these packets to the second and third rules (passthrough=yes). Second rule adds IP address of the client to the address list to enable all successive sessions to go through the same gateway. Third rule places the routing mark "odd" on all packets that belong to the "odd" connection and stops processing all other mangle rules for these packets in prerouting chain.

/ ip firewall mangle 
add chain=prerouting in-interface=Local connection-state=new nth=2,2 \ 
    action=mark-connection new-connection-mark=even passthrough=yes
add chain=prerouting in-interface=Local action=add-src-to-address-list \
  address-list=even address-list-timeout=1d connection-mark=even passthrough=yes 
add chain=prerouting in-interface=Local connection-mark=even action=mark-routing \ 
    new-routing-mark=even passthrough=no

These rules do the same for the remaining half of the traffic as the first three rules for the first half of the traffic.
The code above effectively means that each new connection initiated through the router from the local network will be marked as either "odd" or "even" with both routing and connection marks.
The above works fine. There are however some situations where you might find that the same IP address is listed under both the ODD and EVEN scr-address-lists. This behavior causes issues with apps that require persistent connections. A simple remedy for this situation is to add the following statement to your mangle rules:

add chain=prerouting in-interface=Local connection-state=new nth=2,2 \ 
    src-address-list=!odd action=mark-connection new-connection-mark=even \
    passthrough=yes

This will ensure that the new connection will not already be part of the ODD src-address-list. You will have to do the same for the ODD mangle rule thus excluding IP's already part of the EVEN scr-address-list.

NAT

/ ip firewall nat 
add chain=srcnat out-interface=wlan1 action=masquerade
add chain=srcnat out-interface=wlan2 action=masquerade

Fix the source address according to the outgoing interface.

Routing

/ ip route 
add dst-address=0.0.0.0/0 gateway=10.111.0.1 scope=255 target-scope=10 routing-mark=odd 
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 routing-mark=even

For all traffic marked "odd" (consequently having 10.111.0.2 translated source address) we use 10.111.0.1

gateway. In the same manner all traffic marked "even" is routed through the 10.112.0.1 gateway.

/ ip route
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10

Finally, we have one additional entry specifying that traffic from the router itself (the traffic without any routing marks) should go to 10.112.0.1 gateway.

note:
http://wiki.mikrotik.com/wiki/NTH_load_balancing_with_masquerade

Selasa, 29 November 2011

Howto Upgrade PHP 5.1 To 5.2 on CentOS

Summary from centos official - #

This guide describes how to upgrade the standard PHP 5.1.x packages in CentOS 5.x 32-bit to the current development versions 5.2.x. These instructions were created using CentOS 5.3 32-bit and with the following PHP packages installed:

# rpm -qa |grep php

php-common-5.1.6-15.el5.i386
php-cli-5.1.6-15.el5.i386
php-5.1.6-15.el5.i386
php-pdo-5.1.6-15.el5.i386
php-bcmath-5.1.6-15.el5.i386
php-ldap-5.1.6-15.el5.i386
php-devel-5.1.6-15.el5.i386
php-gd-5.1.6-15.el5.i386
php-xml-5.1.6-15.el5.i386
php-mbstring-5.1.6-15.el5.i386
php-mysql-5.1.6-15.el5.i386
php-dba-5.1.6-15.el5.i386

As long as you're using the standard PHP packages on your CentOS server you won't need to do anything extra. If you're using extra PHP packages that aren't part of the standard CentOS repositories (like php-mcrypt) you'll have to remove them or find updated versions of them.

Add the development repositories

First thing we need to do is add the development repositories to yum. When we add the development repository we're going to configure it so it only pulls PHP packages. To start we'll need create a new yum repository configuration file (use your favorite editor):

# /etc/yum.repos.d/CentOS-Testing.repo

Copy/paste the following into this file:

# CentOS-Testing:
# !!!! CAUTION !!!!
# This repository is a proving grounds for packages on their way to CentOSPlus and CentOS Extras.
# They may or may not replace core CentOS packages, and are not guaranteed to function properly.
# These packages build and install, but are waiting for feedback from testers as to
# functionality and stability. Packages in this repository will come and go during the
# development period, so it should not be left enabled or used on production systems without due
# consideration.
[c5-testing]
name=CentOS-5 Testing
baseurl=http://dev.centos.org/centos/$releasever/testing/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://dev.centos.org/centos/RPM-GPG-KEY-CentOS-testing
includepkgs=php*

Make sure to remove any spaces at the start of each line, then save and close the file and you're done.

Update PHP packages

Before updating your PHP packages you'll want to get a list of what you currently have installed. To get a list of current PHP packages run the following:

# rpm -qa |grep php

Now you can use yum to update the PHP packages on your system:

# yum update

You should be shown a list of packages that are going to be updated. Compare it to the list of PHP packages on your system. Note any packages that are not in the list. You'll need to remove these packages or find updates for them because they won't work after you update to PHP 5.2.x. If that is acceptable type "y" to continue and let yum update the packages.

Once yum has completed restart Apache:

# service httpd restart

To verify the update is working create a simple testing.php in your www directory with the following source code:

phpinfo();
?>

and open it in a web browser. The new PHP version should be reflected at the top of the page.

Conclusion

You should now have PHP 5.2.6 running on CentOS 5.3 32-bit.

# rpm -qa |grep php

php-cli-5.2.6-2.el5s2
php-mbstring-5.2.6-2.el5s2
php-devel-5.2.6-2.el5s2
php-pdo-5.2.6-2.el5s2
php-gd-5.2.6-2.el5s2
php-dba-5.2.6-2.el5s2
php-common-5.2.6-2.el5s2
php-bcmath-5.2.6-2.el5s2
php-xml-5.2.6-2.el5s2
php-pear-1.5.1-2.el5s2
php-ldap-5.2.6-2.el5s2
php-5.2.6-2.el5s2
php-mysql-5.2.6-2.el5s2

# php -v

PHP 5.2.6 (cli) (built: Sep 15 2008 20:42:05)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

Note: If your "php -v" output returns errors about PDO or JSON click here

Extras

Updating/Installing mcrypt

If you have php-mcrypt for PHP 5.1.x installed you'll want to remove it:

Note: Your version number maybe different. Alter below command accordingly.

rpm -e php-mcrypt-5.1.6-15.el5.centos.1

Download php-mcrypt for PHP 5.2.x and install it. You can find a 32-bit php-mcrypt package here FedoraJunkies.

Note: You'll notice the "--nodeps" flag in the example. When you try to install php-mcrypt without it you get an error that php-common-5.2.6-2.el5s2 is missing even though it is installed.

wget -c http://sourcemirrors.org/scotth/centos/5/php/php-mcrypt-5.2.6-2.i386.rpm
rpm -i --nodeps php-mcrypt-5.2.6-2.i386.rpm

Restart Apache and you should now see mcrypt information on your testing.php page.

JSON and PDO being loaded twice

When you run the command "php -v" you might see the following errors:

# php -v

PHP Warning: Module 'json' already loaded in Unknown on line 0
PHP Warning: Module 'PDO' already loaded in Unknown on line 0
PHP 5.2.6 (cli) (built: Sep 15 2008 20:42:05)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

This is caused by the following two lines in the /etc/php.ini file:

; Extension JSON
extension=json.so

; Extension PDO
extension=pdo.so

Comment out these lines by adding a ";" in front of "extension=". These two modules are already loaded via these two files:

/etc/php.d/json.ini
/etc/php.d/pdo.ini

Selasa, 04 Oktober 2011

Install LAMP on Ubuntu 10.04 Lucid simply

LAMP tersedia di repo ubuntu standard bawaan Lucid.
Berikut langkah-langkah proses instalasi yang bisa di lakukan.

Install Apache
sudo apt-get install lamp-server^ (gunakan “^”)
lalu ikuti proses instalasinya.. atau dapat pula menggunakan cara :

sudo apt-get install apache2

Untuk meyakinkan apakah instalasi Apache sudah berhasil atau belum.. dapat dilakukan pengetesan melalui browser dengan mengarahkan ke link berikut :

http://localhost

Bila muncul seperti gambar berikut berarti proses instalasi Apache webserver berhasil.

Install PHP
1. Buka konsol dari terminal kemudian ketikkan command berikut :

sudo apt-get install php5 libapache2-mod-php5

2. Restart webserver dengan menggunakan command :

sudo /etc/init.d/apache2 restart

Test PHP
1. Buat file testing.php pada direktori /var/www/ dengan cara

sudo vim /var/www/testing.php

2. Edit file tersebut dengan menambahkan

< ?php phpinfo(); ?>

3. Cek pada browser ke dengan alamat :

http://localhost/testing.php

Bila instalasi PHP berjalan dengan baik maka akan muncul seperti pada gambar berikut :

Install MySQL
1. Install MySQL dari terminal dengan menggunakan :

sudo apt-get install mysql-server

2. Edit file /etc/mysql/my.cnf dengan menggunakan vim

sudo vim /etc/mysql/my.cnf

Kemudian rubah pada baris

bind-address = 127.0.0.1

menjadi :

bind-address = ip_address_anda

3. Membuat user root pada MySQL dari terminal :

mysql -u root
mysql> SET PASSWORD FOR 'root'@'localhost' = PASSWORD('passwordanda');

Rubah passwordanda dengan password yang anda inginkan.

4. Install aplikasi phpMyadmin agar memudahkan kita dalam mengedit database.

sudo apt-get install libapache2-mod-auth-mysql php5-mysql phpmyadmin

Selanjutnya agar PHP dapat bekerja dengan MySQL edit file php.ini :

sudo vim /etc/php5/apache2/php.ini

Rubah baris berikut :

;extension=mysql.so

menjadi :

extension=mysql.so

Kemudian restart Apache anda :

sudo /etc/init.d/apache2 restart

have a nice day..

re+ thanks bro..

Senin, 05 Oktober 2009

Mikrotik Load Balancing

Mikrotik Load Balancing

Setting Mikrotik ini Terinspirasi dari blog mas Dwi Nanto dan MikroTik Wiki, dan telah disesuaikan dgn Kondisi..

modem 1
10.10.1.1
|
|
10.10.1.2 ——– MIkrotik Load Balancing — 192.168.0.1 — hub — Client
10.10.2.2
|
|
modem 2
10.10.2.1

Pc-Router Speknya
– Dual P-III - 800Mhz
– Memory 64Mb
– IDE Flash Disk 1 Gb

Konfigurasinya

1. Interface Konfigurasi

/ interface ethernet
set Modem1 name=”Modem1" mtu=1500 \
mac-address=00:10:4B:0D:95:02 arp=enabled \
disable-running-check=yes auto-negotiation=yes \
full-duplex=yes cable-settings=default \
speed=100Mbps comment=”" disabled=no

set Lan name=”Lan” mtu=1500 \
mac-address=00:0D:88:B2:7D:50 arp=enabled \
disable-running-check=yes auto-negotiation=yes \
full-duplex=yes cable-settings=default \
speed=100Mbps comment=”" disabled=no

set Modem2 name=”Modem2? mtu=1500 \
mac-address=00:13:46:2C:DE:13 arp=enabled \
disable-running-check=yes auto-negotiation=yes \
full-duplex=yes cable-settings=default \
speed=100Mbps comment=”" disabled=no

2. Ip Address Konfigurasi

/ ip address
add address=192.168.0.1/24 network=192.168.0.0 \
broadcast=192.168.0.255 \
interface=Lan comment=”" disabled=no

add address=10.10.1.2/24 network=10.10.1.0 \
broadcast=10.10.1.255 \
interface=Modem1 comment=”" disabled=no

add address=10.10.2.2/24 network=10.10.2.0 \
broadcast=10.10.2.255 \
interface=Modem2 comment=”" disabled=no

3. Routing IP

/ ip route
add dst-address=0.0.0.0/0 gateway=10.10.2.1 scope=255 \
target-scope=10 routing-mark=odd \
comment=”" disabled=no

add dst-address=0.0.0.0/0 gateway=10.10.1.1 scope=255 \
target-scope=10 routing-mark=even \
comment=”" disabled=no

add dst-address=0.0.0.0/0 gateway=10.10.1.1 scope=255 \
target-scope=10 comment=”" disabled=no

4. Mangle Marking Paket

/ ip firewall mangle
add chain=prerouting in-interface=Lan \
connection-state=new nth=1,1,0 \
action=mark-connection new-connection-mark=odd \
passthrough=yes comment=”Load Balancing” disabled=no

add chain=prerouting in-interface=Lan \
connection-mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no \
comment=”" disabled=no

add chain=prerouting in-interface=Lan \
connection-state=new nth=1,1,1 \
action=mark-connection new-connection-mark=even \
passthrough=yes comment=”" disabled=no

add chain=prerouting in-interface=Lan \
connection-mark=even action=mark-routing \
new-routing-mark=even passthrough=no \
comment=”" disabled=no

add chain=postrouting out-interface=Lan \
dst-address=192.168.0.2 action=mark-packet \
new-packet-mark=operator-down passthrough=no

5. Buat rule nat-masquerade untuk network 192.168.0.0/24 [IP - Firewall - Nat]

/ ip firewall nat
add chain=srcnat src-address=192.168.0.0/24 \
action=masquerade

add chain=srcnat connection-mark=odd action=src-nat \
to-addresses=10.10.2.2 to-ports=0-65535

add chain=srcnat connection-mark=even action=src-nat \
to-addresses=10.10.1.2 to-ports=0-65535

6. Setting DNS
/ ip dns set
primary-dns=202.134.1.10 secondary-dns=202.134.0.155 \
allow-remote-requests=yes cache-size=4096KiB \
cache-max-ttl=1w cache-used=90KiB

Label: Mikrotik

Rabu, 24 Desember 2008

CISCO Learning & Workshop 2009

Kami menyelenggarakan CISCO Learning & Workshop hari minggu (11 Januari 2009) dari jam 09.00 - 16.00 WIB.

Acara ini diselenggarakan sebagai pengetahuan basic/advance mengikuti ujian CISCO Sertifikasi.
Untuk informasi lebih lengkapnya Anda dapat menghubungi sekretariat pendaftaran resmi
ke management ISIC di nomor telp. 0761-62886 atau 0761-8365820 setiap hari kerja.
Biaya registrasi Rp.25.000,- Biaya Learning & Workshop Rp.300.000,-
Segala bentuk pembiayaan harus telah diterima panitia dua hari sebelum tanggal pelaksanaan.
Baik melalui pembayaran langsung maupun transfer.
Untuk pembayaran melalui transfer, bukti pembayaran harus dikirimkan via fax. di nomor faximile 0761-62886 atau email : greenarya.mg@gmail.com

Sabtu, 25 Oktober 2025

WEB APP PENTESTING CHECKLIST

Rabu, 16 Mei 2012

How to Load balancing Mikrotik - NTH mode

Introduction

Quick Start for Impatient

Explanation

IP Addresses

Mangle

NAT

Routing

Selasa, 29 November 2011

Howto Upgrade PHP 5.1 To 5.2 on CentOS

Selasa, 04 Oktober 2011

Install LAMP on Ubuntu 10.04 Lucid simply

Senin, 05 Oktober 2009

Mikrotik Load Balancing

Rabu, 24 Desember 2008

CISCO Learning & Workshop 2009

Blog Archive

Self Think

LIVE STAT

Echo or id

Labels

Comment Art

SunWikis Feed

SecuriTeam Blogs

Slashdot.org

Site Meter