Goof - Snyk's vulnerable demo app
A vulnerable Node.js demo application, based on the Dreamers Lab tutorial.
mongod & git clone https://github.com/Snyk/snyk-demo-todo npm install npm start
To bulk delete the current list of TODO items from the DB run:
npm run cleanup
Exploiting the vulnerabilities
This app uses npm dependencies holding known vulnerabilities.
Here are the exploitable vulnerable packages:
exploits directory includes a series of steps to demonstrate each one.
Fixing the issues
To find these flaws in this application (and in your own apps), run:
npm install -g snyk snyk wizard
In this application, the default
snyk wizard answers will fix all the issues.
When the wizard is done, restart the application and run the exploits again to confirm they are fixed.