Vulnerable Node: vulnerable web site written in NodeJS
What’s this project?
The goal of this project is to be a project with really vulnerable code in NodeJS, not simulated.
A similar project, like OWASP Node Goat, is pretty and useful for learning process but not for a real researcher or studying vulnerabilities in source code, because their code is not really vulnerable but simulated.
This project was created with the purpose of having a project with identified vulnerabilities in source code with the finality of can measure the quality of security analyzers tools.
Although not its main objective, this project also can be useful for:
- Pentesting training.
- Teaching: learn how NOT programming in NodeJS.
The purpose of the project is to provide a real app to test the quality of security source code analyzers in white box processing.
This project has the most common vulnerabilities of
OWASP Top 10 <https://www.owasp.org/index.php/Top_10_2013-Top_10>:
- A1 – Injection
- A2 – Broken Authentication and Session Management
- A3 – Cross-Site Scripting (XSS)
- A4 – Insecure Direct Object References
- A5 – Security Misconfiguration
- A6 – Sensitive Data Exposure
- A8 – Cross-Site Request Forgery (CSRF)
- A10 – Unvalidated Redirects and Forwards
Once docker composes was finished, we can open a browser and type the URL:
127.0.0.1:3000 (or the IP where you deployed the project):
To access the website you can use displayed on the landing page:
- admin: admin
- roberto: asdfpiuw981
Here some images of the site:
Copyright (c) – cr0hn[at]cr0hn.com