dvws-node

DVWS-Node is an intentionally insecure web application for learning how to find security flaws. It includes a browser interface and several ways for software and security tools to communicate with its server: REST, GraphQL, SOAP, and XML-RPC. The exercises cover common flaws in these interfaces and the application behind them. This project replaces DVWS.

What do API and web service mean?

An API is a way for one program to ask another program for data or an action. A web service provides those functions over a network. The terms often overlap. This project offers several formats for sending those requests:

Interface	In simple terms	Example path
REST	Requests to URLs, commonly using JSON	/api/v2/users
GraphQL	A request that names the data it wants	/graphql
SOAP	A formal XML-based request format	/dvwsuserservice
XML-RPC	XML requests that call named methods	/xmlrpc

The browser interface is for people; these interfaces let the browser or other programs communicate with the server. See CHALLENGES.md for exercises and example requests.

Security issues covered

The application includes guided exercises across REST, GraphQL, SOAP, XML-RPC, and browser workflows. See the challenge guide for endpoint details, example requests, and mitigation notes.

• SQL Injection
• NoSQL Injection
• OS Command Injection
• XML External Entity Injection (XXE)
• XML Bomb (Denial of Service)
• Server-Side Request Forgery (SSRF)
• Insecure Deserialization (RCE)
• XPath Injection
• LDAP Injection
• Path Traversal
• SOAP Injection
• XML Injection (Profile Export)
• XML Injection (Profile Import / Mass Assignment)
• Mass Assignment (User Registration)
• IDOR (Insecure Direct Object Reference)
• Broken Authentication (JWT none Algorithm)
• JWT Secret Key Brute Force
• Vertical Access Control (Privilege Escalation)
• Horizontal Access Control
• Open Redirect
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• CORS Misconfiguration
• CRLF Injection / Log Pollution
• User Enumeration
• Information Disclosure
• Sensitive Data Exposure (Password Hashes)
• Prototype Pollution
• API Endpoint Brute Forcing (Missing Rate Limit)
• Rate Limit Bypass via X-Forwarded-For
• Hidden API Functionality Exposure
• GraphQL Introspection
• GraphQL Access Control Issues
• GraphQL Arbitrary File Write
• GraphQL Batching Brute Force
• GraphQL Sensitive Data Exposure
• Unrestricted File Upload
• Role-Based Profile Data Exposure
• Account Recovery IDOR Chain
• Session Revocation After Password Change
• Cookie Security and Cross-Site Behavior
• JSONP Cross-Origin Data Exposure
• Cross-Site WebSocket Hijacking
• Server-Side Template Injection
• Unsafe YAML Supplier Import
• Cached Monthly Report Path Traversal
• Notification Preference Mass Assignment
• Undocumented TRACE Diagnostics
• Legacy Login Skips Password Verification
• Excessive Activity Report Page Size

Set Up Instructions

Manual

Node and NPM is needed to run dvws-node

Requires Node.js 22 and npm. The repository includes an .nvmrc for Node version managers.

Set up a mongoDB environment to listen on port 27017. Docker can be used to quickly set this up.

docker run -d -p 27017:27017 --name dvws-mongo mongo:4.0.4

Create a MySQL database which listens of port 3306 Docker can be used as follows

docker run -p 3306:3306 --name dvws-mysql -e MYSQL_ROOT_PASSWORD=mysecretpassword -e MYSQL_DATABASE=dvws_sqldb -d mysql:8

Git clone the DVWS Repository

git clone https://github.com/snoopysecurity/dvws-node.git

Change directory to DVWS

cd dvws-node

Use Node.js 22 (the version used by the Docker image), then install the dependencies:

npm install

Set the database connection values in .env if your MongoDB or MySQL instances are not using the defaults, then seed the database:

node scripts/seed-database.js

Start the application and API:

npm start

The server uses port 80 by default. Set EXPRESS_JS_PORT in .env to a port above 1024 if you do not want to run it with elevated privileges.

Within your /etc/hosts file, ensure localhost resolves to dvws.local. This ensures URLs from swagger is resolved correctly (optional)

127.0.0.1    dvws.local

Docker Compose

If Docker Compose is installed, start the app and its database services with:

Clone DVWS

git clone https://github.com/snoopysecurity/dvws-node.git

Change directory to dvws-node

cd dvws-node

Start the services

docker compose up --build

This starts DVWS with its MongoDB and MySQL services. For the optional two-origin HTTPS browser exercises, configure local certificates and hostnames as described in the TLS setup section of the challenge guide, then run:

docker compose -f docker-compose.yml -f docker-compose.tls.yml up --build

If the DVWS web service doesn't start because of delayed MongoDB or MySQL setup, then increase the value of environment variable : WAIT_HOSTS_TIMEOUT

Solutions

• DVWS-Node challenge guide

The guide includes password and session exercises, notification inbox and preferences, and cross-origin browser demonstrations. The cross-origin cookie and WebSocket exercises require the optional HTTPS setup; the default HTTP setup supports ordinary same-origin development.

Any Questions

Open a GitHub Issue :)