Vulnerable Node

A deliberately vulnerable Node.js web application for security research and education

• Overview
• Security Disclaimer
• Features
• Quick Start
• Installation
• Configuration
• API Endpoints
• Vulnerabilities
• Project Structure
• Screenshots
• Contributing
• References
• License

Vulnerable Node is an intentionally insecure web application designed with real, exploitable vulnerabilities. Unlike simulated vulnerable applications, this project contains actual security flaws in the source code.

This project was created to:

• Test security analyzers - Measure the quality of static and dynamic security analysis tools
• Train security researchers - Practice identifying and exploiting real vulnerabilities
• Educate developers - Learn how NOT to program in Node.js
• Support penetration testing - Provide a safe, legal target for testing security tools

Similar projects like OWASP NodeGoat use simulated vulnerabilities that don't represent real-world insecure code. Vulnerable Node provides actual vulnerable code patterns that security tools should detect.

The application simulates a small e-commerce shop with:

• User Authentication - Login and logout functionality
• Product Catalog - Browse available products
• Product Search - Search products by name or description
• Product Details - View individual product information
• Purchase System - Buy products (simulated)
• Purchase History - View purchased products

# Clone the repository
git clone https://github.com/cr0hn/vulnerable-node.git
cd vulnerable-node

# Build and start with Docker Compose
docker-compose build && docker-compose up

# Access the application
# Open http://127.0.0.1:3000 in your browser

Default Credentials:

• Docker and Docker Compose (recommended)
• OR Node.js 19.x and PostgreSQL

1. Clone the repository:

git clone https://github.com/cr0hn/vulnerable-node.git
cd vulnerable-node

2. Build and run the containers:

docker-compose build
docker-compose up

3. Access the application at http://127.0.0.1:3000

1. Install PostgreSQL and create a database named vulnerablenode

2. Clone and install dependencies:

git clone https://github.com/cr0hn/vulnerable-node.git
cd vulnerable-node
npm install

3. Set the environment variable:

# For local PostgreSQL
export STAGE=LOCAL

# For development server
export STAGE=DEVEL

4. Start the application:

npm start

The application uses environment variables for configuration:

Database Connections:

This project contains vulnerabilities from the OWASP Top 10 (2013 categories, which align with the OWASP Top 10):

Additional Vulnerabilities:

• Regular Expression Denial of Service (ReDoS)
• Log Injection

The attacks/ directory contains demonstration scripts:

attacks/
├── csrf/           # CSRF attack examples
├── evil_regex/     # ReDoS attack examples
├── sqli/           # SQL injection with sqlmap
└── log_injection.sh

See docs/ATTACKS.md for usage instructions.

vulnerable-node/
├── app.js              # Main Express application
├── config.js           # Database configuration
├── dummy.js            # Seed data
├── package.json        # Dependencies
├── Dockerfile          # Node.js container
├── docker-compose.yml  # Multi-container setup
│
├── bin/
│   └── www             # Server startup
│
├── model/
│   ├── auth.js         # Authentication (SQL injection)
│   ├── init_db.js      # Database initialization
│   └── products.js     # Product queries (SQL injection)
│
├── routes/
│   ├── login.js        # Auth routes
│   ├── login_check.js  # Auth middleware
│   └── products.js     # Product routes
│
├── views/              # EJS templates
├── public/             # Static assets
├── attacks/            # Exploit examples
├── services/           # PostgreSQL setup
└── docs/               # Documentation

See docs/ARCHITECTURE.md for detailed architecture documentation.

Login Screen:

Product Catalog:

Shopping:

Purchase History:

We welcome contributions! Please see CONTRIBUTING.md for guidelines on:

• Adding new vulnerabilities
• Creating attack examples
• Improving documentation
• Code style requirements

Support this project (to solve issues, new features...) by using the GitHub "Sponsor" button.

Resources used in creating this project:

• Node.js Security Checklist
• safe-regex
• OWASP Top 10

This project is released under the BSD License. See LICENSE for details.