Skip to content

lrbecerrab/vulnerable-node-app

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 

Repository files navigation

vulnerable-nodejs-app

A purposely vulnerable NodeJS and MongoDB application

Multiple ways to do NoSQL Injection on Mongo. More to be added.

Starting the app

Using Docker

Docker is the simplest way to get the app running. Just run the following

docker-compose build
docker-compose up

navigate to http://localhost:4000

Running manually

You'll need to install and run a local Mongo instance. On Ubuntu, it's as simple as apt install mongodb. Once running, you may have to specify the db path, or update the config.

$ sudo mongod --dbpath /var/lib/mongodb

Add environment variables MONGO_PORT and MONGO_HOST if not running on localhost and default port. Once mongo is running successfully, start nodemon

cd app; nodemon server

Navigate to http://localhost:4000

Load data

Click on the populate / reset data link on the homepage to load in some users.

Good learning links

https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html https://scotch.io/@401/mongodb-injection-in-nodejs https://isc.sans.edu/forums/diary/Attacking+NoSQL+applications/21787/

About

A NoSQL Injectable Node App

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • JavaScript 63.3%
  • Pug 33.9%
  • Dockerfile 2.8%