attack-review-testbed | hardened Node.js stack | Cybersecurity library

attack-review-testbed is a JavaScript library typically used in Security, Cybersecurity, Nodejs applications. attack-review-testbed has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

Thanks for your interest in attacking the hardened Node demo app. Hopefully seeing what security machinery resists concerted attempt by skilled attackers will help the Node community better safeguard their users' interests. This document explains how to access the target application, and what does and does not constitute a successful breach. Slow Setup Ahead: The target application is meant to be run locally on a machine you control. Setup below builds a patched node runtime from source, which takes over several minutes, so it may be worth starting that running while you browse this document. The target is a simple social-networking web application that lets users post updates. "Setup" explains how to get it up and running. "What is a breach" and "What is not a breach" explain what constitutes a successful attack. Later, there are logistical notes on how to contribute breaches or report other issues. The final section discussion explains how this effort fits into a bigger picture. The target application has an intentionally large attack surface. This application should be easy to breach if it were not for the security machinery under test, so if it resists breach, then the security machinery provides value. Specifically, the target application code does not filter inputs for dangerous patterns, does not explicitly escape outputs, calls require() with a URL path to dispatch to HTTP request handlers, and composes SQL queries and shell strings from untrusted strings without explicit escaping.