Analysis of Local Government Website Vulnerabilities Using the PTES Framework

Abstract

This study aims to analyze and validate security vulnerabilities on the official website of a local government agency, which is a crucial public service portal. The study adopts an adapted Penetration Testing Execution Standard (PTES) methodology, focusing on non-invasive techniques to ensure ethical and responsible assessment of active government systems. Key stages include information gathering, vulnerability scanning using tools such as Nessus, and manual validation using Metasploit and SQLMap. Post-validation analysis confirmed several significant vulnerabilities, with the most critical findings being the exposure of development configuration files to the public and the presence of an outdated version of phpMyAdmin. The study also identified systemic issues such as weak cipher suite support (SWEET32) and configurations that enable DNS amplification attacks. The manual validation process critically succeeded in uncovering false positives from the automated scanner, highlighting the importance of verification by experts. This website exhibits significant security weaknesses due to inadequate patch management and insecure configurations. These findings underscore the urgent need for government agencies to adopt proactive security audits and structured remediation cycles to protect public data and maintain trust in digital services.