Skip to content

Commit 6168deb

Browse files
w3cjw3cj
committed
✨ add vulnerbale node app
1 parent 0f1a98d commit 6168deb

23 files changed

+8938
-0
lines changed

‎sql-injection/README.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SQL Injection
2+
3+
* Notes from Try Hack Me:
4+
* https://tryhackme.com/room/sqlilab
5+
6+
* Prerequisites
7+
* Basics of the SQL language
8+
* What is it?
9+
* Vulnerability in backend codes that allows an attacker to "inject" their own queries into an existing query
10+
* How to prevent it?
11+
* Escape / prepare your queries
12+
* Use a library / ORM
13+
* These typically automatically escape your queries
14+
* Run your queries with the minimum needed permissions
15+
* Use Stored Procedures
16+
* Functions in your database
17+
* You'll be using ? to reference params / args
18+
19+
20+

‎sql-injection/vulnerable-node-app/.env.sample

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
NODE_ENV=development

‎sql-injection/vulnerable-node-app/.eslintrc

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"root": true,
3+
"env": {
4+
"jest": true
5+
},
6+
"parser": "@typescript-eslint/parser",
7+
"parserOptions": {
8+
"project": [
9+
"./tsconfig.json"
10+
]
11+
},
12+
"extends": "airbnb-typescript/base",
13+
"plugins": [
14+
"import",
15+
"@typescript-eslint"
16+
],
17+
"rules": {
18+
"comma-dangle": 0,
19+
"no-underscore-dangle": 0,
20+
"no-param-reassign": 0,
21+
"no-return-assign": 0,
22+
"camelcase": 0,
23+
"import/extensions": 0,
24+
"@typescript-eslint/no-redeclare": 0
25+
},
26+
"settings": {
27+
"import/parsers": {
28+
"@typescript-eslint/parser": [
29+
".ts",
30+
".tsx"
31+
]
32+
},
33+
"import/resolver": {
34+
"typescript": {}
35+
}
36+
}
37+
}

‎sql-injection/vulnerable-node-app/.gitignore

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Logs
2+
logs
3+
*.log
4+
npm-debug.log*
5+
yarn-debug.log*
6+
yarn-error.log*
7+
8+
# Runtime data
9+
pids
10+
*.pid
11+
*.seed
12+
*.pid.lock
13+
14+
# Directory for instrumented libs generated by jscoverage/JSCover
15+
lib-cov
16+
17+
# Coverage directory used by tools like istanbul
18+
coverage
19+
20+
# nyc test coverage
21+
.nyc_output
22+
23+
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
24+
.grunt
25+
26+
# Bower dependency directory (https://bower.io/)
27+
bower_components
28+
29+
# node-waf configuration
30+
.lock-wscript
31+
32+
# Compiled binary addons (https://nodejs.org/api/addons.html)
33+
build/Release
34+
35+
# Dependency directories
36+
node_modules/
37+
jspm_packages/
38+
39+
# TypeScript v1 declaration files
40+
typings/
41+
42+
# Optional npm cache directory
43+
.npm
44+
45+
# Optional eslint cache
46+
.eslintcache
47+
48+
# Optional REPL history
49+
.node_repl_history
50+
51+
# Output of 'npm pack'
52+
*.tgz
53+
54+
# Yarn Integrity file
55+
.yarn-integrity
56+
57+
# dotenv environment variables file
58+
.env
59+
60+
# parcel-bundler cache (https://parceljs.org/)
61+
.cache
62+
63+
# next.js build output
64+
.next
65+
66+
# nuxt.js build output
67+
.nuxt
68+
69+
# vuepress build output
70+
.vuepress/dist
71+
72+
# Serverless directories
73+
.serverless
74+
75+
dist
76+
77+
dev.sqlite3

‎sql-injection/vulnerable-node-app/LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License Copyright (c) 2020 CJ R.
2+
3+
Permission is hereby granted, free
4+
of charge, to any person obtaining a copy of this software and associated
5+
documentation files (the "Software"), to deal in the Software without
6+
restriction, including without limitation the rights to use, copy, modify, merge,
7+
publish, distribute, sublicense, and/or sell copies of the Software, and to
8+
permit persons to whom the Software is furnished to do so, subject to the
9+
following conditions:
10+
11+
The above copyright notice and this permission notice
12+
(including the next paragraph) shall be included in all copies or substantial
13+
portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
16+
ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
18+
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
19+
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20+
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21+
THE SOFTWARE.

‎sql-injection/vulnerable-node-app/README.md

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Express API Starter with Typescript
2+
3+
How to use this template:
4+
5+
```sh
6+
npx create-express-api --typescript --directory my-api-name
7+
```
8+
9+
Includes API Server utilities:
10+
11+
* [morgan](https://www.npmjs.com/package/morgan)
12+
* HTTP request logger middleware for node.js
13+
* [helmet](https://www.npmjs.com/package/helmet)
14+
* Helmet helps you secure your Express apps by setting various HTTP headers. It's not a silver bullet, but it can help!
15+
* [dotenv](https://www.npmjs.com/package/dotenv)
16+
* Dotenv is a zero-dependency module that loads environment variables from a `.env` file into `process.env`
17+
* [cors](https://www.npmjs.com/package/cors)
18+
* CORS is a node.js package for providing a Connect/Express middleware that can be used to enable CORS with various options.
19+
20+
Development utilities:
21+
22+
* [typescript](https://www.npmjs.com/package/typescript)
23+
* TypeScript is a language for application-scale JavaScript.
24+
* [ts-node](https://www.npmjs.com/package/ts-node)
25+
* TypeScript execution and REPL for node.js, with source map and native ESM support.
26+
* [nodemon](https://www.npmjs.com/package/nodemon)
27+
* nodemon is a tool that helps develop node.js based applications by automatically restarting the node application when file changes in the directory are detected.
28+
* [eslint](https://www.npmjs.com/package/eslint)
29+
* ESLint is a tool for identifying and reporting on patterns found in ECMAScript/JavaScript code.
30+
* [typescript-eslint](https://typescript-eslint.io/)
31+
* Tooling which enables ESLint to support TypeScript.
32+
* [jest](https://www.npmjs.com/package/jest)
33+
* Jest is a delightful JavaScript Testing Framework with a focus on simplicity.
34+
* [supertest](https://www.npmjs.com/package/supertest)
35+
* HTTP assertions made easy via superagent.
36+
37+
## Setup
38+
39+
```
40+
npm install
41+
```
42+
43+
## Lint
44+
45+
```
46+
npm run lint
47+
```
48+
49+
## Test
50+
51+
```
52+
npm run test
53+
```
54+
55+
## Development
56+
57+
```
58+
npm run dev
59+
```

‎sql-injection/vulnerable-node-app/jest.config.js

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
/** @type {import('ts-jest/dist/types').InitialOptionsTsJest} */
2+
module.exports = {
3+
preset: 'ts-jest',
4+
testEnvironment: 'node',
5+
modulePathIgnorePatterns: ['<rootDir>/dist/'],
6+
};

‎sql-injection/vulnerable-node-app/knexfile.ts

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import type { Knex } from 'knex';
2+
3+
export const config: { [key: string]: Knex.Config } = {
4+
development: {
5+
debug: true,
6+
client: 'sqlite3',
7+
connection: {
8+
filename: './dev.sqlite3',
9+
},
10+
},
11+
};
12+
13+
export default config;

‎sql-injection/vulnerable-node-app/migrations/20240117191732_user.ts

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import type { Knex } from 'knex';
2+
3+
4+
export async function up(knex: Knex): Promise<void> {
5+
return knex.schema
6+
.createTable('users', (table) => {
7+
table.increments('id');
8+
table.string('username');
9+
table.string('email');
10+
});
11+
}
12+
13+
14+
export async function down(knex: Knex): Promise<void> {
15+
return knex.schema
16+
.dropTable('users');
17+
}
18+

0 commit comments

Comments
 (0)