Vulnerable NodeJS Application

Vulnerable NodeJS application is developed for web application penetration testers, developers and secure code review. It can be easily deployed using docker or by manual install complete steps are provided below. this application will help you in learning how to find vulnerabilities in web applicaiton using black box, white box approach and in learning how to fix them.

How to use it?

Black box testing: Deploy the appplication using docker and start solving the exercises.
Secure code review: Manually install the application this will allow you to use debugger while solving the exercises and will help you in finding vulnerabilities in application code.
Developers: Identify vulnerabilities in application code & try to fix them.

Tech Stack

NodeJS
Application design pattern: MVC
Web framework: Express
Template Engine: EJS
SQL Database: MySQL
NoSQL Database: MongoDB
React to cover ReactJS exercise
JWT for authentication
GraphQL
Socket.IO
Docker

Preview

Complete list of exercises

Command Injection
Insecure Deserialization
SQL Injection
XML external entity injection
XSS
Server Side Template Injection
JWT weak secret
Insecure direct object references
SSRF via PDF generator
postMessage XSS
postMessage CSRF
Information Disclosure using addEventListener
CORS Information Disclosure
CORS CSRF
2FA Insecure Implementation
Cross-Site WebSocket Hijacking
WebSocket XSS
ReactJS href XSS
React ref-innerHTML XSS
NoSQL Injection
GraphQL Information Disclosure
GraphQL SQL Injection
GraphQL CSRF
GraphQL IDOR
XSS using SVG file uplaod
JSONP Injection
NoSQL Javascript Injection

Installation

Using docker-compose

Clone the repository.

git clone https://github.com/payatu/vuln-nodejs-app.git
cd ./vuln-nodejs-app

Download and build the image.

docker-compose up --build -d

Start the application.

docker-compose up -d  # Remove -d flag if you want to see logs

access the application http://localhost:9000

Manual install

Clone the repository.

git clone https://github.com/payatu/vuln-nodejs-app.git
cd ./vuln-nodejs-app

Create MySQL database.

$ mysql -u <mysql_user> -p

mysql> create database vuln_nodejs_app;

Update your MySQL and MongoDB database username and password inside .env file.

DB_PORT=3306
DB_NAME=vuln_nodejs_app
DB_USER=vuln_nodejs_user
DB_PASS=passw0rd
HOST_PORT=9000
JWT_SECRET=secret
MONGODB_SERVER=localhost
MONGODB_ADMINUSERNAME=
MONGODB_ADMINPASSWORD=

Install dependencies.

npm install

Build React frontend.

npm run build

Start the server

node server.js

You can now access the application at http://localhost:9000

Solutions

Available in markdown and pdf format.

PDF: solutions.pdf
Markdown: solutions.md

Contribution

Contributions are always appreciated and you can contribute in this project by following ways:

By adding more exercises.
By reporting issues or by solving open issues.
By making pull request it can be for anything (UI, New Feature, Fixing mistyped words etc)
Don't have time to code but have an idea of exercise open a issue and we will implement it.
By spreading the word about this project.
By doing write-up of exercise we will add your writeup in community write-ups section.

TODO:

~~Dockerize the application~~.
Add more vulnerabilites.
~~Use database to store user information~~.

Author

@tauh33dkhan

payatu / vuln-nodejs-app