Skip to content

Latest commit

 

History

History
42 lines (32 loc) · 905 Bytes

README.md

File metadata and controls

42 lines (32 loc) · 905 Bytes
Raw

Vulnerable Node Express

This is a vulnerable Node Express service meant to be used as a target for security testing tools. All code in this repository is for testing purposes only.

Build and Run

Install NPM Dependencies

npm install

Initialize SQLite DB

node bootstrapdb.js

Run

DEBUG=myapp:* npm start

Build and Run with Docker

Build Docker Image

docker build --tag stackhawk/nodeexpressvulny .

Run Docker Container

docker run --rm --publish 3000:3000 --name nodeexpressvulny stackhawk/nodeexpressvulny

Build and Run in Docker Compose

docker-compose up --build --detach

Known Vulnerabilities

  • SQL Injection via search box. - item%' union all select * from user; --
  • Cross Site Scripting via search box. - <script>alert("hey guy");</script>