Vulnerable Node: vulnerable web site written in NodeJS

by do son · March 11, 2018

Vulnerable Node

What’s this project?

The goal of this project is to be a project with really vulnerable code in NodeJS, not simulated.

Why?

A similar project, like OWASP Node Goat, is pretty and useful for learning process but not for a real researcher or studying vulnerabilities in source code, because their code is not really vulnerable but simulated.

This project was created with the purpose of having a project with identified vulnerabilities in source code with the finality of can measure the quality of security analyzers tools.

Although not its main objective, this project also can be useful for:

Pentesting training.
Teaching: learn how NOT programming in NodeJS.

The purpose of the project is to provide a real app to test the quality of security source code analyzers in white box processing.

Vulnerability list:

This project has the most common vulnerabilities of OWASP Top 10 <https://www.owasp.org/index.php/Top_10_2013-Top_10>:

A1 – Injection
A2 – Broken Authentication and Session Management
A3 – Cross-Site Scripting (XSS)
A4 – Insecure Direct Object References
A5 – Security Misconfiguration
A6 – Sensitive Data Exposure
A8 – Cross-Site Request Forgery (CSRF)
A10 – Unvalidated Redirects and Forwards

Installation

# git clone https://github.com/cr0hn/vulnerable-node.git vulnerable-node

# cd vulnerable-node/

# docker-compose build && docker-compose up

Building postgres_db

Step 1 : FROM library/postgres

---> 247a11721cbd

Step 2 : MAINTAINER "Daniel Garcia aka (cr0hn)" <cr0hn@cr0hn.com>

---> Using cache

---> d67c05e9e2d5

Step 3 : ADD init.sql /docker-entrypoint-initdb.d/

....