[{"_1":2,"_160":-5,"_161":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_138":139},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":17,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137},"canonicalUrl","https://hub.docker.com/r/nirocr/nodegoat/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","nirocr","reponame","nodegoat","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_43":44,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":56,"_39":31,"_28":29,"_58":59,"_60":45,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":29,"_73":74,"_79":11,"_80":81,"_85":29,"_86":87},"categories",[38],{"_39":40,"_41":42},"name","Security","slug","security","content_types",[45],"image","date_registered","2025-06-20T18:41:01.128743Z","description","Vulnerable Application Demonstration","is_private","last_updated","2025-08-21T16:57:28.89953Z","last_modified","2025-08-21T16:57:50.882426Z","media_types",[57],"application/vnd.docker.container.image.v1+json","pull_count",3187,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# NodeGoat\n\nBeing lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.\n\n## Getting Started\n\nOWASP Top 10 for Node.js web applications:\n\n### Know it!\n\nThis application bundled a tutorial page that explains the OWASP Top 10 vulnerabilities and how to fix them.\n\nOnce the application is running, you can access the tutorial page at [http://localhost:4000/tutorial](http://localhost:4000/tutorial) (or the port you have configured).\n\n### Do it!\n\n[A Vulnerable Node.js App for Ninjas](http://nodegoat.herokuapp.com/) to exploit, toast, and fix. You may like to [set up your own copy](#how-to-set-up-your-copy-of-nodegoat) of the app to fix and test vulnerabilities. Hint: Look for comments in the source code.\n\n##### Default user accounts\n\nThe database comes pre-populated with these user accounts created as part of the seed data -\n* Admin Account - u:`admin` p:`Admin_123`\n* User Accounts (u:`user1` p:`User1_123`), (u:`user2` p:`User2_123`)\n* New users can also be added using the sign-up page.\n\n## How to Set Up Your Copy of NodeGoat\n\n### OPTION 1 - Run NodeGoat on your machine\n\n1) Install [Node.js](http://nodejs.org/) - NodeGoat requires Node v8 or above\n\n2) Clone the github repository:\n ```\n git clone https://github.com/OWASP/NodeGoat.git\n ```\n\n3) Go to the directory:\n ```\n cd NodeGoat\n ```\n\n4) Install node packages:\n ```\n npm install\n ```\n\n5) Set up MongoDB. You can either install MongoDB locally or create a remote instance:\n\n * Using local MongoDB:\n 1) Install [MongoDB Community Server](https://docs.mongodb.com/manual/administration/install-community/)\n 2) Start [mongod](http://docs.mongodb.org/manual/reference/program/mongod/#bin.mongod)\n\n * Using remote MongoDB instance:\n 1) [Deploy a MongoDB Atlas free tier cluster](https://docs.atlas.mongodb.com/tutorial/deploy-free-tier-cluster/) (M0 Sandbox)\n 2) [Enable network access](https://docs.atlas.mongodb.com/security/add-ip-address-to-list/) to the cluster from your current IP address\n 3) [Add a database user](https://docs.atlas.mongodb.com/tutorial/create-mongodb-user-for-cluster/) to the cluster\n 4) Set the `MONGODB_URI` environment variable to the connection string of your cluster, which can be viewed in the cluster's\n [connect dialog](https://docs.atlas.mongodb.com/tutorial/connect-to-your-cluster/#connect-to-your-atlas-cluster). Select \"Connect your application\",\n set the driver to \"Node.js\" and the version to \"2.2.12 or later\". This will give a connection string in the form:\n ```\n mongodb://:@/?ssl=true&replicaSet=&authSource=admin&retryWrites=true&w=majority\n ```\n The `` and `` fields need filling in with the details of the database user added earlier. The `` field sets the name of the\n database nodegoat will use in the cluster (eg \"nodegoat\"). The other fields will already be filled in with the correct details for your cluster.\n\n6) Populate MongoDB with the seed data required for the app:\n ```\n npm run db:seed\n ```\n By default this will use the \"development\" configuration, but the desired config can be passed as an argument if required.\n\n7) Start the server. You can run the server using node or nodemon:\n * Start the server with node. This starts the NodeGoat application at [http://localhost:4000/](http://localhost:4000/):\n ```\n npm start\n ```\n * Start the server with nodemon, which will automatically restart the application when you make any changes. This starts the NodeGoat application at [http://localhost:5000/](http://localhost:5000/):\n ```\n npm run dev\n ```\n\n#### Customizing the Default Application Configuration\n\nBy default the application will be hosted on port 4000 and will connect to a MongoDB instance at localhost:27017. To change this set the environment variables `PORT` and `MONGODB_URI`.\n\nOther settings can be changed by updating the [config file](https://github.com/OWASP/NodeGoat/blob/master/config/env/all.js).\n\n### OPTION 2 - Run NodeGoat on Docker\n\nThe repo includes the Dockerfile and docker-compose.yml necessary to set up the app and db instance, then connect them together.\n\n1) Install [docker](https://docs.docker.com/installation/) and [docker compose](https://docs.docker.com/compose/install/) \n\n2) Clone the github repository:\n ```\n git clone https://github.com/OWASP/NodeGoat.git\n ```\n\n3) Go to the directory:\n ```\n cd NodeGoat\n ```\n\n4) Build the images:\n ```\n docker-compose build\n ```\n\n5) Run the app, this starts the NodeGoat application at http://localhost:4000/:\n ```\n docker-compose up\n ```\n\n### OPTION 3 - Deploy to Heroku\n\nThis option uses a free ($0/month) Heroku node server.\n\nThough not essential, it is recommended that you fork this repository and deploy the forked repo.\nThis will allow you to fix vulnerabilities in your own forked version, then deploy and test it on Heroku.\n\n1) Set up a publicly accessible MongoDB instance:\n 1) [Deploy a MongoDB Atlas free tier cluster](https://docs.atlas.mongodb.com/tutorial/deploy-free-tier-cluster/) (M0 Sandbox)\n 2) [Enable network access](https://docs.atlas.mongodb.com/security/ip-access-list/#add-ip-access-list-entries) to the cluster from anywhere (CIDR range 0.0.0.0/0)\n 3) [Add a database user](https://docs.atlas.mongodb.com/tutorial/create-mongodb-user-for-cluster/) to the cluster\n\n2) Deploy NodeGoat to Heroku by clicking the button below:\n\n [![Deploy](https://www.herokucdn.com/deploy/button.png)](https://heroku.com/deploy)\n\n In the Create New App dialog, set the `MONGODB_URI` config var to the connection string of your MongoDB Atlas cluster.\n This can be viewed in the cluster's [connect dialog](https://docs.atlas.mongodb.com/tutorial/connect-to-your-cluster/#connect-to-your-atlas-cluster).\n Select \"Connect your application\", set the driver to \"Node.js\" and the version to \"2.2.12 or later\".\n This will give a connection string in the form:\n ```\n mongodb://:@/?ssl=true&replicaSet=&authSource=admin&retryWrites=true&w=majority\n ```\n The `` and `` fields need filling in with the details of the database user added earlier. The `` field sets the name of the\n database nodegoat will use in the cluster (eg \"nodegoat\"). The other fields will already be filled in with the correct details for your cluster.\n\n## Report bugs, Feedback, Comments\n\n* Open a new [issue](https://github.com/OWASP/NodeGoat/issues) or contact team by joining chat at [Slack](https://owasp.slack.com/messages/project-nodegoat/) or [![Join the chat at https://gitter.im/OWASP/NodeGoat](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/OWASP/NodeGoat?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)\n\n## Contributing\n\nPlease Follow [the contributing guide](CONTRIBUTING.md)\n\n## Code Of Conduct (CoC)\n\nThis project is bound by a [Code of Conduct](CODE_OF_CONDUCT.md).\n\n## Contributors\n\nHere are the amazing [contributors](https://github.com/OWASP/NodeGoat/graphs/contributors) to the NodeGoat project.\n\n## Supports\n\n- Thanks to JetBrains for providing licenses to fantastic [WebStorm IDE](https://www.jetbrains.com/webstorm/) to build this project.\n\n## License\n\nCode licensed under the [Apache License v2.0.](http://www.apache.org/licenses/LICENSE-2.0)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":17,"_83":11,"_84":11},"read","write","admin","user","storage_size",633571365,"orgData","recentTags",[91],{"_92":45,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_51":118,"_119":94,"_120":29,"_121":57,"_39":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":17},"content_type","creator",3447569,"digest","sha256:1384d404f1eb89ba218a5988cccde902bb6b606e3ec70f60b185183f9639c392","full_size",217522762,"id",920720914,"images",[103],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},"architecture","amd64","features","","last_pulled","2026-09-23T17:06:59.059202778Z","last_pushed","2025-06-21T08:24:50.263760168Z","os","linux","os_features","os_version","size","variant","2025-08-21T16:57:27.84834Z","last_updater","last_updater_username","media_type","latest","repository",27776510,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":140,"_148":149,"_136":158,"_159":11},{"_36":141,"_43":143,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":144,"_39":31,"_28":29,"_58":59,"_60":45,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":29,"_73":145,"_79":11,"_80":147,"_85":29,"_86":87},[142],{"_39":40,"_41":42},[45],[57],{"_75":11,"_76":146},[78],{"_82":17,"_83":11,"_84":11},"tags",{"_150":64,"_151":-5,"_152":-5,"_153":154},"count","next","previous","results",[155],{"_92":45,"_93":94,"_95":96,"_97":98,"_99":100,"_101":156,"_51":118,"_119":94,"_120":29,"_121":57,"_39":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":17},[157],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

nirocr/nodegoat

Tags for nirocr/nodegoat