Node.js Goof
Goof is a vulnerable Node.js demo application that includes exploitable packages with known vulnerabilities, Docker Image Scanning for base images with known vulnerabilities in system libraries, and runtime alerts for detecting an invocation of vulnerable functions in open source dependencies. The application includes a series of vulnerabilities, including: * Exploitable packages with known vulnerabilities * Docker Image Scanning for base images with known vulnerabilities in system libraries * Runtime alerts for detecting an invocation of vulnerable functions in open source dependencies * Code-level vulnerabilities * Open Redirect * NoSQL Injection * Code Injection * Cross-site Scripting (XSS) * Information exposure via Hardcoded values in code * Security misconfiguration exposes server information * Insecure protocol (HTTP) communication * Code injection * Local File Inclusion (Path Traversal) vulnerabilities * Regular expression denial of service vulnerabilities The application includes a series of steps to demonstrate each of these vulnerabilities. To run the application, use the following command: npm install && npm start Note: You have to use an old version of MongoDB version due to some of these old libraries' database server APIs. MongoDB 3 is known to work ok. You can also run the MongoDB server individually via Docker, such as: docker run --rm -p 27017:27017 mongo:3 Heroku usage: Goof requires attaching a MongoLab service to be deployed as a Heroku app. CloudFoundry usage: Goof requires attaching a MongoLab service and naming it "goof-mongo" to be deployed on CloudFoundry. Cleanup: To bulk delete the current list of TODO items from the DB, run: npm run cleanup
FEATURES
ALTERNATIVES
Detect users' operating systems and perform redirection with Apache mod_rewrite.
An agentless API security platform that discovers, tests, and secures APIs through source code analysis without requiring traffic monitoring.
An API security solution that provides continuous discovery, classification, and protection of APIs across environments while integrating with existing security infrastructure to prevent attacks and business logic abuse.
A free book providing design and implementation guidelines for writing secure programs in various languages.
A security-focused general purpose memory allocator providing the malloc API with hardening against heap corruption vulnerabilities.
Snyk Code is a real-time SAST tool that provides secure code analysis and actionable remediation advice to prevent code delays and ensure secure development.
PINNED
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Check Point CloudGuard WAF
A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.