Home

Welcome to dvws-node Solutions wiki!

Damn Vulnerable Web Service is a vulnerable web service/API built with an application that can be used to learn about web services and API related vulnerabilities.

This wiki contains solutions to dvws-node.

Note: This guide is currently work in progress.

Solutions

• XML External Entity Injection
• Server Side Request Forgery (SSRF)
• Username Enumeration
• NoSQL Injection
• Insecure Direct Object Reference
• Mass Assignment
• Cross Site Scripting (XSS)
• Hidden API Functionality Exposure
• SQL Injection
• Information Disclosure
• Command Injection
• JSON Hijacking
• XPath Injection
• Cross Origin Resource-Sharing Misonfiguration
• JWT Secret Key Brute Force
• Vertical Access Control
• Horizontal Access Control
• Open Redirect
• Path Traversal
• Unsafe Deserialization
• Sensitive Data Exposure

GraphQL

• Arbitrary File Write
• Introspection Enabled
• GraphQL Access Control Issues
• GraphQL Batching Brute Force

JavaScript Security

• Insecure PostMessage Configuration
• Prototype Pollution
• Client Side Template Injection

New Solutions

• Solutions Cheatsheet (For To-Do Items)