You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+10-4Lines changed: 10 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,14 +3,19 @@
3
3
Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
4
4
5
5
## Getting Started
6
+
6
7
OWASP Top 10 for Node.js web applications:
7
8
8
9
### Know it!
10
+
9
11
[Tutorial Guide](http://nodegoat.herokuapp.com/tutorial) explaining how each of the OWASP Top 10 vulnerabilities can manifest in Node.js web apps and how to prevent it.
10
12
11
13
### Do it!
14
+
12
15
[A Vulnerable Node.js App for Ninjas](http://nodegoat.herokuapp.com/) to exploit, toast, and fix. You may like to [set up your own copy](#how-to-set-up-your-copy-of-nodegoat) of the app to fix and test vulnerabilities. Hint: Look for comments in the source code.
16
+
13
17
##### Default user accounts
18
+
14
19
The database comes pre-populated with these user accounts created as part of the seed data -
15
20
* Admin Account - u:admin p:Admin_123
16
21
* User Accounts (u:user1 p:User1_123), (u:user2 p:User2_123)
@@ -73,11 +78,11 @@ The database comes pre-populated with these user accounts created as part of the
73
78
```
74
79
75
80
#### Customizing the Default Application Configuration
81
+
76
82
By default the application will be hosted on port 4000 and will connect to a MongoDB instance at localhost:27017. To change this set the environment variables `PORT` and `MONGODB_URI`.
77
83
78
84
Other settings can be changed by updating the [config file](https://github.com/OWASP/NodeGoat/blob/master/config/env/all.js).
79
85
80
-
81
86
### OPTION 2 - Run NodeGoat on Docker
82
87
83
88
The repo includes the Dockerfile and docker-compose.yml necessary to set up the app and db instance, then connect them together.
@@ -104,7 +109,6 @@ The repo includes the Dockerfile and docker-compose.yml necessary to set up the
104
109
docker-compose up
105
110
```
106
111
107
-
108
112
### OPTION 3 - Deploy to Heroku
109
113
110
114
This option uses a free ($0/month) Heroku node server.
@@ -131,10 +135,9 @@ This will allow you to fix vulnerabilities in your own forked version, then depl
131
135
The `<username>` and `<password>` fields need filling in with the details of the database user added earlier. The `<dbname>` field sets the name of the
132
136
database nodegoat will use in the cluster (eg "nodegoat"). The other fields will already be filled in with the correct details for your cluster.
133
137
134
-
135
138
## Report bugs, Feedback, Comments
136
-
* Open a new [issue](https://github.com/OWASP/NodeGoat/issues) or contact team by joining chat at [Slack](https://owasp.slack.com/messages/project-nodegoat/) or [](https://gitter.im/OWASP/NodeGoat?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
137
139
140
+
* Open a new [issue](https://github.com/OWASP/NodeGoat/issues) or contact team by joining chat at [Slack](https://owasp.slack.com/messages/project-nodegoat/) or [](https://gitter.im/OWASP/NodeGoat?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
0 commit comments