Build: Build the Vulnerable App

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

Node.js 18+Required
Runtime for the Express API
Get it ↗
express, pg, bcryptRequired
npm install express pg bcrypt @types/bcrypt
PostgreSQL (local or Docker)Required
docker run -p 5432:5432 -e POSTGRES_PASSWORD=dev postgres:16
OWASP ZAPOptional
For dynamic scanning in Step 4
Get it ↗

💥

Step 1 of 4

Build the Vulnerable App

Create an intentionally vulnerable Express API with SQL injection, IDOR, and weak password storage to learn by seeing the attack surface.

Tasks

Create `src/routes/users.ts` with a raw SQL string interpolation endpoint

Create `src/routes/invoices.ts` without any ownership check

Hash a test password with MD5 and observe the hash length

🎯 What You'll Learn

▸Understand what SQL injection looks like in code
▸Recognise IDOR (A01 Broken Access Control)
▸See why MD5 is unsafe for passwords

Code

TypeScriptsrc/routes/users-vulnerable.ts
1 import { Router } from 'express';
2 import { pool } from '../db';
3  
4 const router = Router();
5  
6 // A03: Injection — VULNERABLE (for demonstration only)
7 router.get('/user', async (req, res) => {
8   const query = `SELECT * FROM users WHERE id = ${req.query.id}`;
9   console.log('Executing:', query);  // Log the injection
10   const { rows } = await pool.query(query);
11   res.json(rows);
12 });
13  
14 export default router;
15

💡 Pro Tips

▸Run this on localhost ONLY — never deploy a vulnerable app to any shared environment

Expected Output

GET /user?id=1 OR 1=1-- returns all rows

Discussion

1 import { Router } from 'express'; 2 import { pool } from '../db'; 3 4 const router = Router(); 5 6 // A03: Injection — VULNERABLE (for demonstration only) 7 router.get('/user', async (req, res) => { 8 const query = `SELECT * FROM users WHERE id = ${req.query.id}`; 9 console.log('Executing:', query); // Log the injection 10 const { rows } = await pool.query(query); 11 res.json(rows); 12 }); 13 14 export default router; 15

1	import { Router } from 'express';
2	import { pool } from '../db';
3
4	const router = Router();
5
6	// A03: Injection — VULNERABLE (for demonstration only)
7	router.get('/user', async (req, res) => {
8	const query = `SELECT * FROM users WHERE id = ${req.query.id}`;
9	console.log('Executing:', query); // Log the injection
10	const { rows } = await pool.query(query);
11	res.json(rows);
12	});
13
14	export default router;
15