Whispers
0 (0)
A static code analysis tool for parsing common data formats to detect hardcoded credentials and dangerous functions.
Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup
A static code analysis tool for parsing common data formats to detect hardcoded credentials and dangerous functions.
A tool for identifying potential security vulnerabilities in web applications
A lightweight web security auditing toolkit that simplifies security tasks and enhances productivity.
OpenRASP directly integrates its protection engine into the application server by instrumentation, providing context-aware protection and detailed stack trace logging.
IronBee is an open source project building a universal web application security sensor.
A Java API for searching and downloading Android applications from Google Play with additional check-in features for generating ANDROID-ID.