Node.js Goof Logo

Node.js Goof

0
Free
Visit Website

Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup

FEATURES

ALTERNATIVES

AWS Web Application Firewall (WAF) for protecting web applications from common exploits.

Cross-site scripting labs for web application security enthusiasts

A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.

A browser with XSS detection capabilities

Static application security testing (SAST) tool for scanning source code against security and privacy risks.

A security feature to prevent unexpected manipulation of fetched resources.

JavaScript parser, minifier, compressor, and beautifier toolkit with simplified API and CLI.

SAST and malware analysis tool for Android APKs with detailed scan information.