nodejs-security

NodeJS Red-Team Cheat Sheet

A Collection of articles, videos, blogs, talks and other materials on Node.js Security

My personal study notes for the exam OpenJS Node Services Developer (JSNSD) and LFW212 course labs

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks, helping make your website resistant to SSRF attacks when implemented correctly.

Learning path for becoming nodejs developer from zero to hero. These series includes steps to become nodejs developers for beginner to experienced developers

Defensive static analysis and detection engineering for the 2026 Shai-Hulud npm supply-chain campaign: Sigma/YARA rules, IOCs, ATT&CK mapping, and defender guidance.

A multithreaded, (mostly) async mass Node.js vulnerability scanner.

This is a set of hacking tools written in NodeJS

SystemGuard - Prozessüberwachung und Firewall-Schutz

Awesome Node.js Security resources

Professional TryHackMe CTF walkthrough for Fool's Mate, Revenge, documenting server-side authorization analysis, API enumeration, prototype pollution, JavaScript object inheritance abuse, reward-gate bypass, exploitation methodology, remediation, and portfolio-ready GitHub Pages documentation.

This project is designed to benchmark the performance of bcrypt hashing at different salt rounds. It helps in determining the optimal number of rounds for hashing passwords, balancing security and performance.

one common template that follows in all CTF walkthroughs

Secure Node.js e-commerce backend with JWT authentication, refresh token rotation, and protected route middleware.

Helmet + OWASP Top 10:2025 in one zero-dependency import. Ultra-lightweight security middleware for Node.js

It's a comprehensive Node.js project aimed at implementing a wide range of security measures to ensure robust protection during transmission to safeguarding against common security pitfalls.

Professional walkthrough of the Do Not Disturb TryHackMe room, demonstrating web application exploitation through NoSQL Injection, Server-Side Template Injection, Remote Code Execution and Linux privilege escalation using debugfs and the disk group. Includes methodology, attack chain, screenshots, mitigations, and GitHub Pages documentation.

Security Explained in a different way : Nodejs | ReactJs | React Native | Database

PowerShell forensic toolkit for auditing Node.js development environments. Detects npm supply chain attacks, hidden task execution, and obfuscated malware processing.