NodeGoat Documentation

NodeGoat provides a Dockerfile and docker-compose.yml to orchestrate the application and a database instance automatically.

1. Install Docker and Docker Compose.
2. Clone the repository and enter the directory:

   git clone https://github.com/OWASP/NodeGoat.git
   cd NodeGoat

3. Build the images:

   docker-compose build

4. Start the application:

   docker-compose up

The application will be available at http://localhost:4000/.

To run NodeGoat on your local machine, ensure you have Node.js (v8 or above) and MongoDB installed. Follow these steps:

1. Clone the repository:

   git clone https://github.com/OWASP/NodeGoat.git
   cd NodeGoat

2. Install dependencies:

   npm install

3. Set up MongoDB (Local or Remote Atlas):
   • If using local MongoDB, ensure mongod is running.
   • If using MongoDB Atlas, set the MONGODB_URI environment variable to your cluster connection string.
4. Seed the database:

   npm run db:seed

5. Start the application:
   • For production-like mode (runs on port 4000):

     npm start

   • For development mode with auto-restart (runs on port 5000):

     npm run dev

NodeGoat is designed to teach the OWASP Top 10 vulnerabilities in Node.js applications.

Learning via Tutorial

Access the built-in tutorial page to understand vulnerabilities and their fixes at: http://localhost:4000/tutorial (or your configured port).

Hands-on Exploitation

Use the pre-populated user accounts to test vulnerabilities:

• Admin Account: user admin, password Admin_123
• User Accounts: user1/User1_123, user2/User2_123

Tip: Check the source code for comments that may guide your exploitation or fixing efforts.

You can deploy NodeGoat to Heroku using a free tier. It is recommended to fork the repository first so you can deploy your own fixed versions.

1. Set up a publicly accessible MongoDB Atlas cluster.
2. Enable network access for the cluster from anywhere (CIDR 0.0.0.0/0).
3. Add a database user to the cluster.
4. Use the Heroku deploy button to create a new app.
5. In the Heroku app settings, configure the MONGODB_URI environment variable with your Atlas connection string (using the Node.js driver version 2.2.12 or later).

You can customize the default application behavior by setting the following environment variables:

• PORT: Sets the port the application is hosted on (default is 4000).
• MONGODB_URI: Sets the connection string for the MongoDB instance (default is localhost:27017).

For more advanced settings, refer to the configuration file in config/env/all.js.

You can deploy NodeGoat using the provided docker-compose.yml file. This setup orchestrates two services: a web service running the NodeGoat application and a mongo service running MongoDB 4.4.

By default, the application is accessible on port 4000 of your host machine. The web service includes a startup script that waits for the MongoDB service to be ready before executing a database reset (node artifacts/db-reset.js) and starting the application via npm start.

When using Docker Compose, you can customize the application behavior using the following environment variables in the web service:

• NODE_ENV: Sets the Node.js environment (e.g., development, production).
• MONGODB_URI: The connection string for the MongoDB instance. The default value is mongodb://mongo:27017/nodegoat.

services:
  web:
    environment:
      NODE_ENV: development
      MONGODB_URI: mongodb://mongo:27017/nodegoat

NodeGoat uses swig for HTML templating, managed through the consolidate adapter. The engine is configured to look for .html files in the ${__dirname}/app/views directory.

Warning: In its current state, swig.setDefaults({ autoescape: false }) is configured, which disables automatic HTML escaping and contributes to XSS vulnerabilities.

app.engine(".html", consolidate.swig);
app.set("view engine", "html");
app.set("views", `${__dirname}/app/views`);

swig.setDefaults({
    // Autoescape disabled
    autoescape: false
});

The marked library is used for parsing Markdown. It is initialized with specific options and made available to the application templates via app.locals.marked.

marked.setOptions({
    sanitize: true
});
app.locals.marked = marked;