Scribd
Upload
18 views45 pages

NodeJS Security Testing Techniques

This document discusses hacking NodeJS applications for fun and profit. It provides an introduction to NodeJS security, describes common NPM security packages like Helmet and Express Session, and demonstrates tools like Node Goat that can be used to test NodeJS application security. Attack vectors like XSS, CSRF, insecure deserialization are covered, along with defenses like input validation, CSRF tokens, and disabling dangerous functions like eval(). The presentation recommends resources for continued learning about NodeJS security best practices.

Uploaded by

MohammedYehia
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
18 views45 pages

NodeJS Security Testing Techniques

This document discusses hacking NodeJS applications for fun and profit. It provides an introduction to NodeJS security, describes common NPM security packages like Helmet and Express Session, and demonstrates tools like Node Goat that can be used to test NodeJS application security. Attack vectors like XSS, CSRF, insecure deserialization are covered, along with defenses like input validation, CSRF tokens, and disabling dangerous functions like eval(). The presentation recommends resources for continued learning about NodeJS security best practices.

Uploaded by

MohammedYehia
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

See discussions, stats, and author profiles for this publication at: [Link]

net/publication/338825372

Hacking NodeJS applications for fun and profit

Presentation · February 2019


DOI: 10.13140/RG.2.2.34059.44322

CITATIONS READS

0 457

1 author:

José Manuel Ortega


University of Alicante
28 PUBLICATIONS   0 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Python Security View project

Docker Security View project

All content following this page was uploaded by José Manuel Ortega on 25 January 2020.

The user has requested enhancement of the downloaded file.


Hacking NodeJS
applications for fun
and profit
Testing NodeJS Security

by @jmortegac
Agenda

▪ Introduction nodejS security


▪ Npm security packages
▪ Node Goat project
▪ Tools
Node JS
▪ JavaScript in the backend
▪ Built on Chrome´s Javascript runtime(V8)
▪ NodeJs is based on event loop
▪ Designed to be asynchronous
▪ Single Thread
▪ [Link] is resilient to flooding attacks since
there’s no limit on the number of concurrent requests.
Security [Link]
d/[Link]
updates
Package [Link]
vulnerabilities
▪ Helmet
Npm ▪ express-session
security ▪ cookie-session
packages ▪ csurf
▪ express-validator
▪ bcrypt-node
▪ express-enforces-ssl
Security HTTP
Headers ▪ Strict-Transport-Security
▪ X-Frame-Options
▪ X-XSS-Protection
▪ X-Content-Type-Options
▪ Content-Security-Policy
▪ [Link]
Helmet module /helmet
▪ [Link]

Helmet module
▪ hidePoweredBy
Helmet module ▪ Hpkp→protection MITM
▪ Hsts→forces https
connections
▪ noCache→desactive client
cache
▪ Frameguard→protection
clickjacking
▪ xssFilter→protection XSS
Helmet CSP
▪ [Link]
Check headers ▪ [Link]
security
Express ▪ [Link]
versions search?query=express
Disable
x-powered-by
Disable ▪ Avoid framework
x-powered-by fingerprinting
Disable ▪ Use Helmet and use
“hide-powered-by” plugin
x-powered-by
▪ [Link]
Sessions
age/cookie-session
management
▪ secure
▪ httpOnly
▪ domain
▪ path
▪ expires
httpOnly &
secure:true
XSS attacks
▪ An attacker can exploit XSS vulnerability to:
▪ Steal session cookies/Sesion hijacking
▪ Redirect user to malicious sites
▪ Defacing and content manipulation
▪ Cross Site Request forgery
CSRF attacks
[Link]
[Link](function (request, response, next) {
CSRF [Link] =
[Link]();
next();
});

<form action="/process" method="POST">


<input type="hidden" name="_csrf"
value="{{csrfToken}}">
<button type="submit">Submit</button>
</form>
CSRF
Filter/sanitize user input

▪ Fixing XSS attacks


▪ [Link]

▪ Module express-validator
▪ [Link]
Express
Validator
▪ [Link]

Bcrypt-node
▪ [Link]
Node Goat /tutorial
▪ [Link]
Node Goat Goat
[Link](require('fs').read
EVAL() dirSync('.').toString())
ATTACKS
Insecure Direct ▪ Use session instead of
Object request param
References ▪ var userId =
[Link];
Tools
▪ KrakenJS
▪ Lusca
middleware
▪ NodeJsScan
[Link]
[Link]
▪ [Link]
NodeJsScan ham/NodeJsScan
NodeJsScan [Link]
a/NodeJsScan/blob/maste
r/[Link]
NodeJsScan
GitHub repositories

▪ [Link]
▪ [Link]
▪ [Link]
▪ [Link]
ed-intermediate
▪ [Link]
Node security ▪ [Link]
pentesting-and-exploitation/
learning
Books
References
▪ [Link]
▪ [Link]
▪ [Link]
▪ [Link]
▪ [Link]
▪ [Link]
▪ [Link]
t_Project

View publication stats

You might also like