Vulnerable Node

Vulnerable Node is a small web shop written in NodeJS with real vulnerabilities in the code. Not simulated: real.

Why it exists

When you build a code analyzer, you need something to test it against. The vulnerable apps that existed, such as OWASP NodeGoat, are fine for learning but not for measuring a tool: their flaws are simulated, and a serious analyzer does not find them because they are not really there.

I wrote Vulnerable Node for the opposite. An application with the flaws sitting in the source code, in identifiable places, so you can answer one concrete question: how many of these does your tool find?

What is inside

The most common flaws from the OWASP Top 10: injection, broken authentication and sessions, XSS, insecure direct object references, security misconfiguration, sensitive data exposure, CSRF and unvalidated redirects. All inside a shop with login, catalog and purchases, so the code looks like a real application and not like a sample form.

How you use it

One docker compose up brings the app and its database up. You log in with the test users shown on the landing page and start breaking things.

It is used to measure code analyzers, to practice pentesting and to teach how not to write NodeJS. That last one is the use people mention most.

480 stars on GitHub.