Comments (3)
Thanks, will consider this.
from nodejsscan.
Feature Added.
$ python cli.py -d /Users/ajin/Code/Node.Js-Security-Course/
[INFO] Running Static Analyzer Running on - /Users/ajin/Code/Node.Js-Security-Course/
{"files": [{"LICENSE": "/Users/ajin/Code/Node.Js-Security-Course/LICENSE"}, {"dir_traversal.js": "/Users/ajin/Code/Node.Js-Security-Course/dir_traversal.js"}, {"node-mongo.js": "/Users/ajin/Code/Node.Js-Security-Course/node-mongo.js"}, {"hpp.js": "/Users/ajin/Code/Node.Js-Security-Course/hpp.js"}, {"nodejsshell.py": "/Users/ajin/Code/Node.Js-Security-Course/nodejsshell.py"}, {"README.md": "/Users/ajin/Code/Node.Js-Security-Course/README.md"}, {"eval.js": "/Users/ajin/Code/Node.Js-Security-Course/eval.js"}, {".gitignore": "/Users/ajin/Code/Node.Js-Security-Course/.gitignore"}, {"global_scope.js": "/Users/ajin/Code/Node.Js-Security-Course/global_scope.js"}, {"simple_server.js": "/Users/ajin/Code/Node.Js-Security-Course/simple_server.js"}, {"redos.js": "/Users/ajin/Code/Node.Js-Security-Course/redos.js"}, {"command execution.js": "/Users/ajin/Code/Node.Js-Security-Course/command execution.js"}, {"deserialization.js": "/Users/ajin/Code/Node.Js-Security-Course/deserialization.js"}, {"fs.js": "/Users/ajin/Code/Node.Js-Security-Course/fs.js"}, {".gitORIG_HEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/ORIG_HEAD"}, {".gitconfig": "/Users/ajin/Code/Node.Js-Security-Course/.git/config"}, {".gitHEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/HEAD"}, {".gitdescription": "/Users/ajin/Code/Node.Js-Security-Course/.git/description"}, {".gitindex": "/Users/ajin/Code/Node.Js-Security-Course/.git/index"}, {".gitpacked-refs": "/Users/ajin/Code/Node.Js-Security-Course/.git/packed-refs"}, {".gitCOMMIT_EDITMSG": "/Users/ajin/Code/Node.Js-Security-Course/.git/COMMIT_EDITMSG"}, {".gitFETCH_HEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/FETCH_HEAD"}, {".gitobjects/59/d842baa84c8bf4a041873b61233d12a585816c": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/59/d842baa84c8bf4a041873b61233d12a585816c"}, {".gitobjects/57/e2fca634ae1f0ccf490c8667de95ae9f0d8aa1": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/57/e2fca634ae1f0ccf490c8667de95ae9f0d8aa1"}, {".gitobjects/35/50ea1a08aca5b43cbd97b985b0fc7f52d60079": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/35/50ea1a08aca5b43cbd97b985b0fc7f52d60079"}, {".gitobjects/9d/b17f139e7a17ade977ddb49723a64ddbfd9426": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/9d/b17f139e7a17ade977ddb49723a64ddbfd9426"}, {".gitobjects/a3/54af12aa468a31f8a896e74feb80a162b800f6": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/a3/54af12aa468a31f8a896e74feb80a162b800f6"}, {".gitobjects/b2/1a28e9bbe0622bb2f812fdecd1b5fabafbcc15": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/b2/1a28e9bbe0622bb2f812fdecd1b5fabafbcc15"}, {".gitobjects/b3/5dc667c6812c61b787e7298410cc8d621fe386": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/b3/5dc667c6812c61b787e7298410cc8d621fe386"}, {".gitobjects/a2/c6521db8739a15266df69e3f44c68faacc10d5": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/a2/c6521db8739a15266df69e3f44c68faacc10d5"}, {".gitobjects/d1/addaa5b523bbb77c5719fa1db80bdeab48df2a": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/d1/addaa5b523bbb77c5719fa1db80bdeab48df2a"}, {".gitobjects/ab/f7c42e3d997ba5734e0652ca02d4ff2240ed0f": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/ab/f7c42e3d997ba5734e0652ca02d4ff2240ed0f"}, {".gitobjects/eb/e7ab7878eb30647b551eee34adee4a3b4e2211": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/eb/e7ab7878eb30647b551eee34adee4a3b4e2211"}, {".gitobjects/e4/76ed726be25c30da47922c7bc42c829105b988": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/e4/76ed726be25c30da47922c7bc42c829105b988"}, {".gitobjects/ec/17d33eae793c680abefb376c1bcf34fe36bc9d": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/ec/17d33eae793c680abefb376c1bcf34fe36bc9d"}, {".gitobjects/20/de7c109528986d928db4beef5e7f53b4bd220b": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/20/de7c109528986d928db4beef5e7f53b4bd220b"}, {".gitobjects/4b/0e17362821dcff5fd9b1da68440f74f8ce55f1": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/4b/0e17362821dcff5fd9b1da68440f74f8ce55f1"}, {".gitobjects/28/d188c183720837d00ca64866141bdb21fc3813": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/28/d188c183720837d00ca64866141bdb21fc3813"}, {".gitobjects/17/0300613ff0a0793982dcf47fa4ecb56491c4d3": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/17/0300613ff0a0793982dcf47fa4ecb56491c4d3"}, {".gitobjects/2f/120d5221f2dd82c9b494a1fe1fc3db6f3ff695": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/2f/120d5221f2dd82c9b494a1fe1fc3db6f3ff695"}, {".gitobjects/6b/156fe1db9c5cd21ca1c68b7025bae40d0c5764": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/6b/156fe1db9c5cd21ca1c68b7025bae40d0c5764"}, {".gitobjects/3f/6e830ff5ee4e059b639698e6c24b7b724f2db7": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/3f/6e830ff5ee4e059b639698e6c24b7b724f2db7"}, {".gitobjects/37/82636e8058ac848c16ccc174013f5949e5c9ed": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/37/82636e8058ac848c16ccc174013f5949e5c9ed"}, {".gitobjects/08/5f5bac1765b33c23f4f0df03a49bd6ed3e7c48": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/08/5f5bac1765b33c23f4f0df03a49bd6ed3e7c48"}, {".gitobjects/01/b41367a87294b12faf274b4c31396ec1fe116c": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/01/b41367a87294b12faf274b4c31396ec1fe116c"}, {".gitobjects/0a/ef667eecd9623cb7282e6a25c532b843d8de94": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/0a/ef667eecd9623cb7282e6a25c532b843d8de94"}, {".gitobjects/90/9c621b9516e3f2b8fc3c74bbff56f2a0e70243": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/90/9c621b9516e3f2b8fc3c74bbff56f2a0e70243"}, {".gitobjects/b0/160266e7a5ce946723146c4794163b21de7c82": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/b0/160266e7a5ce946723146c4794163b21de7c82"}, {".gitobjects/ea/1eaba9fb8343b8cc715193111f6b44baf510e3": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/ea/1eaba9fb8343b8cc715193111f6b44baf510e3"}, {".gitobjects/e9/81c6edd6ed10410bce85c5fba48ac33d44e8a9": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/e9/81c6edd6ed10410bce85c5fba48ac33d44e8a9"}, {".gitobjects/f1/fd947483ea6fb0109a065f5386414fe41988a4": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/f1/fd947483ea6fb0109a065f5386414fe41988a4"}, {".gitobjects/2c/4b1b814498865e4c77d44869e2ccc57aae72b4": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/2c/4b1b814498865e4c77d44869e2ccc57aae72b4"}, {".gitobjects/8d/b46a333ce8e63f9efb77b9b20c928f1b15127c": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/8d/b46a333ce8e63f9efb77b9b20c928f1b15127c"}, {".gitobjects/8e/c9f14468c4a3746d1385cbdd193066fda97fbc": "/Users/ajin/Code/Node.Js-Security-Course/.git/objects/8e/c9f14468c4a3746d1385cbdd193066fda97fbc"}, {".gitinfo/exclude": "/Users/ajin/Code/Node.Js-Security-Course/.git/info/exclude"}, {".gitlogs/HEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/logs/HEAD"}, {".gitlogs/refs/heads/master": "/Users/ajin/Code/Node.Js-Security-Course/.git/logs/refs/heads/master"}, {".gitlogs/refs/remotes/origin/HEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/logs/refs/remotes/origin/HEAD"}, {".gitlogs/refs/remotes/origin/master": "/Users/ajin/Code/Node.Js-Security-Course/.git/logs/refs/remotes/origin/master"}, {".githooks/commit-msg.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/commit-msg.sample"}, {".githooks/pre-rebase.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/pre-rebase.sample"}, {".githooks/pre-commit.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/pre-commit.sample"}, {".githooks/applypatch-msg.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/applypatch-msg.sample"}, {".githooks/prepare-commit-msg.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/prepare-commit-msg.sample"}, {".githooks/post-update.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/post-update.sample"}, {".githooks/pre-applypatch.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/pre-applypatch.sample"}, {".githooks/pre-push.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/pre-push.sample"}, {".githooks/update.sample": "/Users/ajin/Code/Node.Js-Security-Course/.git/hooks/update.sample"}, {".gitrefs/heads/master": "/Users/ajin/Code/Node.Js-Security-Course/.git/refs/heads/master"}, {".gitrefs/remotes/origin/HEAD": "/Users/ajin/Code/Node.Js-Security-Course/.git/refs/remotes/origin/HEAD"}, {".gitrefs/remotes/origin/master": "/Users/ajin/Code/Node.Js-Security-Course/.git/refs/remotes/origin/master"}], "good_finding": {}, "total_count": {"mis": 8, "good": 0, "sec": 3}, "sec_issues": {"Remote Code Injection": [{"sha2": "c852c46da2ff4300ecc5df666328ca54151aa715a883abbc28fac84c37a9b2be", "description": "User controlled data in eval() can result in Server Side Injection (SSI) or Remote Code Execution (RCE).", "title": "Server Side Injection(SSI) - eval()", "lines": "var express = require('express');\nvar app = express();\napp.get('/', function(req, res) {\n var resp = eval(\"(\" + req.query.name + \")\");\n res.send('Response</br>' + resp);\n});\napp.listen(8000);", "filename": "eval.js", "tag": "rci", "path": "/Users/ajin/Code/Node.Js-Security-Course/eval.js", "line": 4}, {"sha2": "06f3f0ff3deed27aeb95955a17abc7722895d3538c14648af97789d8777cee50", "description": "User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.", "title": "Deserialization Remote Code Injection", "lines": "app.use(cookieParser())\n\napp.get('/', function(req, res) {\n if (req.cookies.profile) {\n var str = new Buffer(req.cookies.profile, 'base64').toString();\n var obj = serialize.unserialize(str);\n if (obj.username) {\n res.send(\"Hello \" + escape(obj.username));\n }\n } else {", "filename": "deserialization.js", "tag": "rci", "path": "/Users/ajin/Code/Node.Js-Security-Course/deserialization.js", "line": 11}], "Cross Site Scripting (XSS)": [{"sha2": "ea2354a755f62f5bf3ac2e2283e52b8b95898844e4aec455efe1cdb4ff739835", "description": "Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability", "title": "XSS - Reflected Cross Site Scripting", "lines": "var express = require('express');\nvar app = express();\napp.get('/', function(req, res) {\n res.send('id: ' + req.query.id);\n console.log(\"GET / id=\" + req.query.id);\n});\napp.listen(3000);", "filename": "hpp.js", "tag": "xss", "path": "/Users/ajin/Code/Node.Js-Security-Course/hpp.js", "line": 4}]}, "vuln_count": {"Deserialization Remote Code Injection": 1, "Server Side Injection(SSI) - eval()": 1, "XSS - Reflected Cross Site Scripting": 1}, "missing_sec_header": {"Web Security": [{"tag": "web", "description": "X-Frame-Options (XFO) header provides protection against Clickjacking attacks.", "title": "Missing Security Header - X-Frame-Options (XFO)"}, {"tag": "web", "description": "Content Security Policy (CSP), a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). CSP Header was not found.", "title": "Missing Security Header - Content-Security-Policy (CSP)"}, {"tag": "web", "description": "Strict-Transport-Security (HSTS) header enforces secure (HTTP over SSL/TLS) connections to the server.", "title": "Missing Security Header - Strict-Transport-Security (HSTS)"}, {"tag": "web", "description": "Remove the X-Powered-By header to prevent information gathering.", "title": "Infromation Disclosure - X-Powered-By"}, {"tag": "web", "description": "X-Content-Type-Options header prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.", "title": "Missing Security Header - X-Content-Type-Options"}, {"tag": "web", "description": "X-Download-Options header set to noopen prevents IE users from directly opening and executing downloads in your site's context.", "title": "Missing Security Header - X-Download-Options: noopen"}, {"tag": "web", "description": "X-XSS-Protection header set to 1 enables the Cross-site scripting (XSS) filter built into most recent web browsers.", "title": "Missing Security Header - X-XSS-Protection:1"}, {"tag": "web", "description": "Public-Key-Pins (HPKP) ensures that certificate is Pinned.", "title": "Missing Security Header - Public-Key-Pins (HPKP)"}]}}
from nodejsscan.
Noice 👍
from nodejsscan.
Related Issues (20)
- [Feature Request] Allow configuration files HOT 1
- Not detecting any errors HOT 2
- Nodejsscan failing : Attaching logs HOT 2
- Exception on /upload/ HOT 6
- Not written in Node HOT 1
- NodeJSScan fails locally on requirements.txt step HOT 2
- Hangs on upload HOT 2
- module is stuck at pattern match HOT 1
- Feature Request: Download results file via web UI HOT 1
- Bug: Crash on what appears to be empty file HOT 3
- Javascript Framework HOT 1
- Getting json.decoder.JSONDecodeError HOT 1
- first project scan HOT 1
- Wrong nodejsscan version is displayed HOT 2
- RuntimeError: Cannot add child handler, the child watcher does not have a loop attached HOT 6
- Base image contains vulnerabilities HOT 1
- Python 3.7 is not available in the latest docker image HOT 1
- Feature Request - Google Chat Alerts
- module 'sqlalchemy' has no attribute '__all__'. Did you mean: '__file__'? HOT 2
- Error HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nodejsscan.