Home

Awesome

Gitpod Ready-to-Code

dvws-node

Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities. This is a replacement for https://github.com/snoopysecurity/dvws

DVWS

This vulnerable application contains the following API/Web Service vulnerabilities:

Set Up Instructions

Manual (Preferred Method)

Node and NPM is needed to run dvws-node

Tested on:

Set up a mongoDB environment to listen on port 27017. Docker can be used to quickly set this up.

docker run -d -p 27017-27019:27017-27019 --name dvws-mongo mongo:4.0.4

Create a MySQL database which listens of port 3306 Docker can be used as follows

docker run -p 3306:3306 --name dvws-mysql -e MYSQL_ROOT_PASSWORD=mysecretpassword -e MYSQL_DATABASE=dvws_sqldb -d mysql:8

Git clone the DVWS Repository

git clone https://github.com/snoopysecurity/dvws-node.git

Change directory to DVWS

cd dvws-node

npm install all dependencies (build from source is needed for libxmljs, you might also need install libxml depending on your OS: sudo apt-get install -y libxml2 libxml2-dev)

npm install --build-from-source

Run the startup script which create some test data

node startup_script.js

To start the application/API, run (sudo privileges is needed to bind to ports)

sudo npm start

Within your /etc/hosts file, ensure localhost resolves to dvws.local. This ensures URLs from swagger is resolved correctly (optional)

127.0.0.1    dvws.local

Docker Compose

If you have docker compose installed on your system, all you need to execute is :

Clone DVWS

git clone https://github.com/snoopysecurity/dvws-node.git

Change directory to dvws-node

cd dvws-node

Start Docker

`docker-compose up`

This will start the dvws service with the backend MySQL database and the NoSQL database.

If the DVWS web service doesn't start because of delayed MongoDB or MySQL setup, then increase the value of environment variable : WAIT_HOSTS_TIMEOUT

Solutions

To Do

Any Questions

Open a GitHub Issue :)