Skip to content
A NoSQL Injectable Node App
JavaScript HTML Dockerfile
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
app
.gitignore
README.md
docker-compose.yml

README.md

vulnerable-nodejs-app

A purposely vulnerable NodeJS and MongoDB application

Multiple ways to do NoSQL Injection on Mongo. More to be added.

Starting the app

Using Docker

Docker is the simplest way to get the app running. Just run the following

docker-compose build
docker-compose up

navigate to http://localhost:4000

Running manually

You'll need to install and run a local Mongo instance. On Ubuntu, it's as simple as apt install mongodb. Once running, you may have to specify the db path, or update the config.

$ sudo mongod --dbpath /var/lib/mongodb

Add environment variables MONGO_PORT and MONGO_HOST if not running on localhost and default port. Once mongo is running successfully, start nodemon

cd app; nodemon server

Navigate to http://localhost:4000

Load data

Click on the populate / reset data link on the homepage to load in some users.

Good learning links

https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html https://scotch.io/@401/mongodb-injection-in-nodejs https://isc.sans.edu/forums/diary/Attacking+NoSQL+applications/21787/

You can’t perform that action at this time.