Skip to content

Latest commit

 

History

History
139 lines (100 loc) · 6.43 KB

README.md

File metadata and controls

139 lines (100 loc) · 6.43 KB

web_lab

A full-stack web application that uses Docker, Node.js, Express, and React to demonstrate the OWASP Top 10 API Security Risks – 2019.

Accomplishments

  • Injection (SQL Injection)
  • Cross-Site Scripting (XSS)
  • Broken User Authentication (Security Assertion Markup Language (SAML))
  • Broken Object Level Authorization
  • Excessive Data Exposure
  • Lack of Resources & Rate Limiting
  • Mass Assignment
  • Security Misconfiguration
  • Improper Assets Management
  • Insufficient Logging & Monitoring

Preview

Here's a preview of what the projects looks like:

web_lab login Screenshot web_lab main Screenshot

Table of Contents

About the Project

This project involves creating a web application that will serve as the main platform for users to practice exploiting web application vulnerabilities and learn about web application security. It will include a range of vulnerable web applications that users can test their skills on, including injection attacks, broken authentication and session management, and insufficient logging and monitoring. The website will be designed to be user-friendly and accessible to users of all skill levels. Specific features and functions, such as the types of vulnerabilities to be covered, will be further developed in the planning stage.

The web application will be used to demonstrate how these vulnerabilities can be exploited and how to prevent them. It will involve setting up a testing environment that simulates real-world scenarios. The lab will cover a range of vulnerabilities, including injection attacks, broken authentication and session management, and insufficient logging and monitoring. Overall, the project is an exciting opportunity to contribute to the field of web application security and make a positive impact in this area.

Framework

This is a modern, scalable, and maintainable full-stack web applications. By using Docker, we can easily package and deploy your application across different environments, while Node.js and Express provide the server-side infrastructure for handling HTTP requests and serving dynamic content. Finally, React enables you to build rich and interactive user interfaces that can communicate with backend APIs.

Getting Started

Include information about how to get started with the project. This include prerequisites and installation instructions.

Prerequisites

Before you get started with this project, you'll need to have the following tools installed:

  • Docker (v18 or higher)

Installation

You can download Docker from the official website: https://www.docker.com/products/docker-desktop

Once you have Docker installed, you can proceed with setting up the project.

Usage

To use the project, follow the instructions below:

  • Start the project by running the web_lab.sh script:
./web_lab.sh start

The script will handle the setup and execution of the project.

  • Stopping the Project:

To stop the project, run the following command:

./web_lab.sh stop

This will stop both the backend, frontend servers and all containers.

  • Restarting the Project:

If you need to restart the project, you can use the following command:

./web_lab.sh restart

Roadmap

Phase 1: Setup and Configuration

  1. Create project repository and README file
  2. Determine the necessary tools and dependencies for the development environment, such as the programming language, framework, and database, and install them
  3. Configure Docker setup for the web application
  4. Develop a main website for users to practice exploiting web application vulnerabilities
  5. Integrate a Docker-in-Docker (dind) setup in the project

Phase 2: Vulnerability Demonstrations

  1. Implement injection attack demonstrations (SQL injection, command injection, etc.)
  2. Implement broken authentication and session management demonstrations
  3. Implement cross-site scripting (XSS) and cross-site request forgery (CSRF) demonstrations
  4. Implement insufficient logging and monitoring demonstrations

Phase 3: Penetration Testing and Vulnerability Exploration

  1. Conduct penetration testing to identify additional vulnerabilities and weaknesses in the web application
  2. Explore and experiment with different tools and techniques for identifying and exploiting vulnerabilities

Phase 4: Fixing Vulnerabilities

  1. Analyze and prioritize vulnerabilities found in the testing phase
  2. Develop and implement fixes for identified vulnerabilities
  3. Conduct additional testing to ensure vulnerabilities are successfully fixed

Phase 5: Documentation and Publication

  1. Create detailed documentation on the vulnerabilities demonstrated and how to prevent them
  2. Publish the project on a public platform (GitHub, etc.) for others to use and learn from
  3. Provide guidance and resources for users to continue learning and exploring web application security on their own.

Contributing

License

This project is licensed under the terms of the MIT License. See the LICENSE file for details.

This project uses the following open source components:

Contact

If you have any questions or suggestions about this project, please feel free to reach out to us at:

Acknowledgements

We would like to express our sincere gratitude to the following individuals/organizations for their contributions to this project: