nodejsscan

by ajinabraham

2.6Kstars

342forks

54watchers

Updated about 1 month ago

About

nodejsscan is a static security code scanner that detects vulnerabilities in Node.js applications through a web UI, CLI, and API.

nodejsscan is a static security code scanner for Node.js applications.

Primary Use Case

This tool is primarily used by developers and security professionals to identify security flaws in Node.js codebases before deployment. It integrates into DevSecOps pipelines to automate security scanning and provides alerts via Slack and email for continuous monitoring.

Key Features

Static Application Security Testing (SAST) for Node.js
Powered by libsast and semgrep for deep code analysis
Web user interface for interactive scanning and results visualization
Command Line Interface (CLI) and Python API for automation
Slack and Email alert integrations for vulnerability notifications
Support for CI/CD pipelines including GitHub Actions, GitLab CI/CD, and Travis CI
Docker images available for easy deployment
PostgreSQL backend for storing scan results and configurations

Installation

Install PostgreSQL and configure SQLALCHEMY_DATABASE_URI in nodejsscan/settings.py or as an environment variable
Clone the repository: git clone https://github.com/ajinabraham/nodejsscan.git
Navigate into the directory: cd nodejsscan
Create a Python virtual environment: python3 -m venv venv
Activate the virtual environment: source venv/bin/activate
Install dependencies: pip install -r requirements.txt
Create database schema: python3 manage.py recreate-db (run once)
Run the application: ./run.sh
Access the web UI at http://127.0.0.1:9090
Alternatively, pull and run the Docker image: docker pull opensecurity/nodejsscan:latest

Usage

>_ docker pull opensecurity/nodejsscan:latest

Pull the latest Docker image for nodejsscan

>_ docker run -it -p 9090:9090 opensecurity/nodejsscan:latest

Run nodejsscan Docker container exposing web UI on port 9090

>_ git clone https://github.com/ajinabraham/nodejsscan.git

Clone the nodejsscan repository locally

>_ python3 -m venv venv

Create a Python virtual environment

>_ source venv/bin/activate

Activate the Python virtual environment

>_ pip install -r requirements.txt

Install required Python dependencies

>_ python3 manage.py recreate-db

Initialize or recreate the database schema

>_ ./run.sh

Start the nodejsscan web user interface locally

Security Frameworks

Reconnaissance

Initial Access

Defense Evasion

Discovery

Impact

Usage Insights

Integrate nodejsscan into CI/CD pipelines for automated pre-deployment vulnerability detection.
Leverage Slack and email alerting features for real-time vulnerability notifications to development and security teams.
Use the Python API to build custom automation workflows that trigger scans on code commits or pull requests.
Combine nodejsscan findings with runtime application security monitoring tools to enhance detection coverage.
Incorporate nodejsscan results into purple team exercises to simulate attacker exploitation and improve defensive controls.