dvna - Damn Vulnerable NodeJS Application

项目说明

Damn NodeJS Application (DVNA)

!d

Damn NodeJS Application (DVNA) is a simple NodeJS application to demonstrate OWASP Top 10 and guide on fixing and a these . The fixes branch will contain fixes for the . Fixes for OWASssP Top 10 2017 at fixes-2017 branch.

The application is powered by commonly used libraries such as express, passport, sequelize, etc.

De Security Guide book

The application comes with a de friendly comprehensi which can be used to learn, avoid and fix the . The guide is a at docs and covers the following

1. Instructions for setting up DVNA
2. Instructions on exploiting the
3. code snippets and instructions on fixing
4. Recommendations for avoid such
5. References for learning more

The blog post for this release is at

You can setup a local gitbook server to access the documentation using the following commands. The documentation will then be accessible on

Quick start

Try D a single command with Docker. This setup uses an SQLite database instead of MySQL.

Access the application at

Getting Started

DVNA can be deployed in three ways

1. For De, using docker-compose with auto-reload on code updates
2. For Security Testers, using the Official image from Docker Hub
3. For Ad Users, using a fully manual setup

Detailed instructions on setup and requirements are given in the Guide Gitbook

1. De Setup

Clone this repository

Create a vars.env with the desired database configuration

Start the application and database using docker-compose

Access the application at

The application will automatically reload on code changes, so feel free to patch and play around with the application.

Using Official Docker Image

Create a file named vars.env with the following configuration

Start a MySQL container

Start the application using the official image

Access the application at and start testing!

Manual Setup

Clone the repository

Configure the en with your database information

Install Dependencies

Start the application

Access the application at

TODO

Contributing

In case of bugs in the application, please create an issue on github. Pull requests are highly welcome!

Thanks

Abhisek Datta - abhisek for application architecture and front-end code

License

MIT

项目信息

开发语言：SCSS

Star 数：779

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Damn Vulnerable NodeJS Application展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。