JavaScript
You're viewing a free preview. Sign in free to read every script.
Why this exists Node services are attacked in the same few ways: a file name that climbs out of its folder, text glued into a shell command, a JSON body that rewrites Object.prototype, a password stored badly or logged,…
Secure Node.js Basics: Path Traversal, Command Injection, Prototype Pollution, Secrets, SSRF and Dependencies
The mistakes behind most real Node.js incidents, each shown as a working attack and a working fix: reading files outside a folder (including the prefix-check bug), shell injection, prototype pollution, weak password handling and secrets in logs, server-side request forgery, and supply-chain risk in npm.
Sign in free to read this script, along with the rest of the library.
Sign in free