Oh My Original Pentest

Base URLs

Scope

IN:

• *.omoppanel.my.id semua subdomain kecuali status. dan mail.
• Semua endpoint HTTP/HTTPS di base URLs di atas
• Mobile API backend (kontrak sama dengan web API)
• Email/SMS flow (password reset, OTP) domain omoppanel.my.id

OUT:

• DoS / DDoS / flood / brute force massal
• Social engineering karyawan & user lain
• Physical, phishing luar domain
• VPS / infra di balik domain (159.223.51.28 jangan di-scan langsung)
• CVE known tanpa exploitation chain novel
• 3rd party (Cloudflare, Let's Encrypt, provider lain)

Rules of Engagement

• 1 IP = 1 peserta. IP kamu di-bind saat pertama request. IP lain dari jaringan berbeda ditolak.
• Tanpa proxy / VPN / Tor / relay apa pun. Deteksi = auto-ban permanen.
• Tanpa Cloudflare Warp / DNS changer. Harus jaringan asli ISP kamu.
• Rate limit: max 20 req/detik per IP. Lewat = block 10 menit.
• No destructive payload (DROP/DELETE massal), no account deletion.
• Report format: JSON, schema di /report-schema.json.
• Semua chain wajib dibuktikan end-to-end. Single bug tanpa chain = tidak dihitung.

Anti-DDoS

• Semua target di-balik Cloudflare Tunnel — origin IP tidak terexpose ke publik.
• Serangan DDoS diserap Cloudflare edge. Origin tetap bersih.
• WAF: Cloudflare managed rules + rate limiting rules aktif.

Scoring