A vulnerable Express.js + Node.js API and Frontend

Warning

This application is not intended for production. It was heavily influenced by real life code.

USE WITH CAUTION

Quick Start with docker

Install Docker
Run docker pull sirappsec/nodejs-vulnerable-app Run docker run --rm -p 5000:5000 sirappsec/nodejs-vulnerable-app
Browse to http://localhost:3000 (on macOS and Windows browse to http://192.168.99.100:3000 if you are using docker-machine instead of the native docker installation)

Purpose

Test your skills, try to pentest and find the vulnerabilities
Use to Asses DAST/SAST tools for Node.js/Express.js applications
Learn how not to write code

Advantages over NodeGoat

While NodeGoat cover mostly OWASP Top 10(inc SSRF and ReDos). This project have more vulnerabilities, multiple exploit chains and other weaknesses like low hanging fruits that are commonly found in production and enterprise level applications.

Vulnerabilities/Weaknesses

Sql injection
Business Logic
XXE - XML External Entity
RCE - Remote Code Execution
Session Fixation
Improper Password Strengh Controls
Hard Coded Secrets
Insufficient Randomness
Path Traversal
Privileged Interface Exposure
Leftover Debug Code
Authentication Credentials In URL
Insecure OTP/2FA/MFA
Vertical Privilege escalation
Horizontal Privilege escalation
Insecure Object Deserialization
CSRF - Cross Site Request Forgery
SSRF - Server Side Request Forgery)
Click Jacking / Lack of Security Headers
Insecure Redirect
Vulnerable and Outdated Components (Probably, lol)
Forced Browsing
Password Hash With Insufficient Computational Effort
Excessive data exposure
PII Leak - Personal Identifiable Information Exposure
BOLA - Broken Object Level Authorization
Broken user Authentication
Mass Assignment
User Enumeration
Improper Asset management
Broken Function Level
IDOR - Insecure Direct Object References
DOS - Denial of Service
ReDoS - Regular Expression Denial Of Service
Insufficient Logging & Monitoring
Insecure JWT Implementation
Uverified JWT manipulation
JWT Secret Key Brute Force
Template injection (SSTI)
Reflected+ Stored XSS - Cross Site Scripting

Todo

Insecure TLS Validation
Arbitrary file writes
Type Confusion
Prototype pollution
Log injection
Host header poisoning
Encryption vulnerabilities
Trust boundary violations
Web Socket Security
NoSQL Injection
JSON Hijacking

How to Install

docker-compose up or nativaly npm run dev

Docs

The swagger docs clearly state the type of vulnerability/exploitation method As expected, only some methods require authentication/authorization, mostly for the sake of brevity, although the most common (IMO) auth vulnerabilities are present in the application.