Vulnerabilities assessment of a web-based human resources management system using a penetration testing approach (hrms.tic.gov.tl)

Idalia Francisca Viegas, Kadek Yota Ernanda Aryanto and I Ketut Resika Arthana
Additional contact information
Idalia Francisca Viegas: Ganesha University of Education
Kadek Yota Ernanda Aryanto: Ganesha University of Education
I Ketut Resika Arthana: Ganesha University of Education

Priviet Social Sciences Journal, 2026, vol. 6, issue 5, 411-424

Abstract: This study presents mini penetration testing assessment conducted on the Human Resource Management System (HRMS) hosted at https://hrms.tic.gov.tl . This assessment aims to evaluate the security level of the system by considering the aspects of Confidentiality, Integrity, and Availability (CIA) through several processes, including reconnaissance, vulnerability scanning, and security configuration analysis. The assessment process was conducted using various automated security tools such as Nuclei, Nmap, Subfinder, and Acunetix to identify potential security weaknesses within the web application environment. The testing activities were conducted on November 2025 using passive and semi-active approaches without exploitation activities, in accordance with ethical considerations, organizational authorization, and operational security boundaries. The assessment identified several Low and Informational findings related to missing security headers, insecure cookie configurations, and weak client-side security settings. Although no High or Critical vulnerabilities were identified, the findings should not be interpreted as evidence that the system is fully secure because the assessment scope did not include exploitation or internal infrastructure testing. The results indicate that additional hardening, preventive controls, and continuous security governance mechanisms are still necessary to strengthen the overall security posture of the HRMS environment. Recommendations based on ISO/IEC 27001, Zero Trust principles, and Web Application Firewall protection are proposed to improve organizational cybersecurity resilience.

Keywords: HRMS; penetration testing; vulnerability assessment; cybersecurity; ISO/IEC 27001/22 (search for similar items in EconPapers)
Date: 2026
References: Add references at CitEc
Citations:

Downloads: (external link)
https://journal.privietlab.org/download.php?id=12980 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:prv:pssjpv:1801

Ordering information: This journal article can be ordered from
https://journal.priv ... SJ/article/view/1801

DOI: 10.55942/pssj.v6i5.1801

Access Statistics for this article

More articles in Priviet Social Sciences Journal from Privietlab Research Center
Bibliographic data for series maintained by Mochammad Fahlevi ().