4 ms·
We've been working on an example vulnerable app to showcase vulnerable dependencies in web apps. (Think a CVE in an NPM package.) I've been wanting that so tha
by freeqaz 4y ago
We've been working on an example vulnerable app to showcase vulnerable dependencies in web apps. (Think a CVE in an NPM package.)
I've been wanting that so that I can test out different security scanning and patching tools, but also actually build a test playground to exploit vulnerable dependencies. (I want to accelerate exploit development for CVEs by making it more standardized.)
If you have a CVE that you'd like to write a POC exploit scenario for, you can add it to this project quickly and easily with pre-built templates[1]! (Wasp[2] is an awesome project that simplifies web dev tooling complexity.)
Are there any other projects with similar goals that anybody is aware of? Asking because I couldn't find any, but I'd love to merge efforts if somebody is already doing this!
0: https://github.com/lunasec-io/damn-vulnerable-js-sca https://github.com/lunasec-io/damn-vulnerable-js-sca
1: https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/master/wasp/template https://github.com/lunasec-io/damn-vulnerable-js-sca/tree/ma...
2: https://wasp-lang.dev/ https://wasp-lang.dev/
- sally_glance 4y agoI just want to say thanks for this, we used it for an internal workshop for our webdev department with very limited prior netsec experience and it was a big hit. The AIO character and a little bit of gamification through the leaderboard made it an easy to setup but really fun event! Edit: Damn, I should read before posting - was talking about the juice shop. Your project might be nice follow-up though!