Node.js Goof

0

Free

Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup