0xbharath / dvna-sqlite

Damn Vulnerable NodeJS Application (DVNA)

Damn Vulnerable NodeJS Application (DVNA) is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vunerabilities OWASP Top 10 2017 vulnerabilities at fixes-2017 branch.

The application is powered by commonly used libraries such as express, passport, sequelize, etc.

The application comes with a developer friendly comprehensive guidebook which can be used to learn, avoid and fix the vulnerabilities. The guide available at https://appsecco.com/books/dvna-developers-security-guide/ covers the following

1. Instructions for setting up DVNA
2. Instructions on exploiting the vulnerabilities
3. Vulnerable code snippets and instructions on fixing vulnerabilities
4. Recommendations for avoid such vulnerabilities
5. References for learning more

The blog post for this release is at https://blog.appsecco.com/damn-vulnerable-nodejs-application-dvna-by-appsecco-7d782d36dc1e

Getting Started (SQLite)

• Start the application using below docker command

docker run --name dvna -p 9090:9090 -d appsecco/dvna:sqlite

• Access the application at http://127.0.0.1:9090

TODO

• Link commits to fixes in documentation
• Add new vulnerabilities from OWASP Top 10 2017
• Improve application features, documentation

Contributing

In case of bugs in the application, please create an issue on github. Pull requests are highly welcome!

Thanks

Abhisek Datta - abhisek for application architecture and front-end code

License

MIT