https://github.com/effortlessdevsec/ninjasworkout
Vulnerable NodeJS Web Application
https://github.com/effortlessdevsec/ninjasworkout
bugbounty nodejs penetration-testing vulnerability-assessment
Last synced: 2 days ago
JSON representation
Vulnerable NodeJS Web Application
- Host: GitHub
- URL: https://github.com/effortlessdevsec/ninjasworkout
- Owner: effortlessdevsec
- Created: 2021-10-22T05:34:09.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2024-08-22T04:50:55.000Z (over 1 year ago)
- Last Synced: 2024-11-21T18:38:48.906Z (about 1 year ago)
- Topics: bugbounty, nodejs, penetration-testing, vulnerability-assessment
- Language: Pug
- Homepage:
- Size: 5.72 MB
- Stars: 87
- Watchers: 5
- Forks: 29
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - effortlessdevsec/ninjasworkout - Vulnerable NodeJS Web Application (Pug)
README
# Damn Vulnerable NodeJS Application
## Quick Start
```
Download the Repo =>
run npm i
```
Afer Installing all dependency just run the application
```
node app.js or nodemon app.js
```
## ADDED BUGS
- Prototype Pollution ✅1
- No SQL Injection ✅2
- Cross site Scripting ✅3
- Broken Access Control ✅4
- Broken Session Management ✅5
- Weak Regex Implementation ✅ 6
- Race Condition ✅7
- CSRF -Cross Site Request Forgery ✅8
- Weak Bruteforce Protection ✅9
- User Enumeration ✅10
- Reset Password token leaking in Referrer ✅11
- Reset Password bugs ✅12
- Sensitive Data Exposure ✅13
- Unicode Case Mapping Collision ✅14
- File Upload ✅ 15
- SSRF ✅ 16
- XXE
- Open Redirection ✅ 17
- Directory Traversal ✅ 18
- Insecure Deserilization => Remote Code Execution ✅ 19
- Server Side Template Injection 🚶♂️🚶♂️🚶
- Timing Attack 🚶♂️🚶♂️🚶
⚠️⚠️ Reset Password Module will not work !! You have to configure SMTP !! in utils=>sendmail.js⚠️⚠️
# TODO
- Improvement in User Interface
- Add New Vulnerabilities on weekly basis
- Add Documentation of all the Vulnerabilites
# Issues
- In case of bugs in the application, feel free to create an [issues](https://github.com/effortlessdevsec/ninjasworkout/issues) on github.
# Contribution
- Feel free to create a pull request for any contribution.