Node.js Goof
Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup
FEATURES
ALTERNATIVES
OWASP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application for client-server communication with numerous vulnerabilities.
A simple Swagger-ui scanner that detects old versions vulnerable to various XSS attacks
Websecurify provides efficient ways to protect organizations with sophisticated technology and expert consultancy.
A tool for identifying potential security vulnerabilities in dependency configurations by checking for lingering free namespaces for private package names.
An automated code security tool that analyzes repositories, identifies vulnerabilities, and generates pull requests with fixes while integrating with existing development workflows.
A tool for identifying potential security vulnerabilities in web applications
BunkerWeb is a next-generation and open-source Web Application Firewall (WAF) with seamless integration and user-friendly customization options.
Python-based web server framework for setting up fake web servers and services with precise data responses.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.