CVE-2017-14849

Docker goof version of breaking into a container

Goof - Snyk's application demo for breaking into containers Purpose of this repository is to demonstrate a Nodejs web application that is packaged as a container, and shows container-level vulnerabilities that result in breaking into the container Vulnerabilities and exploitation is: The vanilla Nodejs base image node:610-wheezy ships with a vulnerable image of Image

Docker goof version of breaking into a container

Goof - Snyk's application demo for breaking into containers Purpose of this repository is to demonstrate a Nodejs web application that is packaged as a container, and shows container-level vulnerabilities that result in breaking into the container Vulnerabilities and exploitation is: The vanilla Nodejs base image node:610-wheezy ships with a vulnerable image of Image

Node js 8.5 exploit

Demonstration of CVE-2017-14849 This exploit lets any user allowed to GET a static file from an express server running express-4152 and node v85 read any file the user running the webserver has access to on the host system Conveniently express shipped an exploitable example in the source Prerequisites Docker Try it out Build the image: docker build -t exploit Start the

Nodejs 디렉터리 탐색 취약점(CVE-2017-14849) 취약점 개요 Node js 850에서는 파일 경로 정규화(Path Normalization) 취약점이 있습니다 상위 레이어(예: //////etc/passwd)로 이동하는 중에 바르지 못한 폴더가 있는 경우 (예: ///foo////etc/passwd) 오류가 발생해야 하지만 파일 경로 정규화(Pa

Docker goof version of breaking into a container

Goof - Snyk's application demo for breaking into containers Purpose of this repository is to demonstrate a Nodejs web application that is packaged as a container, and shows container-level vulnerabilities that result in breaking into the container Vulnerabilities and exploitation is: The vanilla Nodejs base image node:610-wheezy ships with a vulnerable image of Image

Security Knowledge Structure(安全知识汇总)

Security Knowledge Structure 欢迎大家提交ISSUE和Pull Requests。 1 企业安全 11 黑盒扫描 静态xss检测 对AWVS一次简单分析 初见Chrome Headless Browser 用phantomJS检测URL重定向 用SlimerJS检测Flash XSS 12 白盒扫描器 Cobra 13 WAF自建 如何建立云WAF 如何建立HTTPS的云WAF ngx_lua_waf VeryNginx lua-resty-waf 14 堡垒机 ju