Node.js Goof Logo

Node.js Goof

0
Free
Visit Website

Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup

FEATURES

ALTERNATIVES

A tool that safely installs packages with npm/yarn by auditing them as part of your install process.

A Burp extension for scanning JavaScript files for endpoint links

Detect trojan source attacks that employ unicode bidi attacks to inject malicious code.

An API security and monitoring platform that automatically discovers, validates, and protects API endpoints while providing comprehensive management and analytics capabilities.

An API security and governance platform that provides discovery, security testing, compliance monitoring and lifecycle management capabilities for enterprise API implementations.

An API security platform that combines discovery, compliance monitoring, and protection capabilities to defend against API attacks, automated threats, and data exposure.

WPRecon is a tool for recognizing vulnerabilities and blackbox information for WordPress.

A tool for secure content publishing and verification using offline signing and trusted collections.

PINNED