# DVWS-node (Damn Vulnerable Web Services) — practice target

DVWS-node is a deliberately-vulnerable web-services app (Node/Express) covering
a broad span: command injection (`/api/v2/sysinfo/{command}`), XXE (XML
import/export), LFI/path traversal (`/download`), BOLA/IDOR (`/api/v2/notes/{id}`,
`/api/v2/users/{id}/profile-details`), LDAP injection, SSTI/reflected input,
open redirect, mass assignment (`/api/v2/admin/create-user` admin field), plus
XML-RPC and GraphQL side services. Project:
https://github.com/snoopysecurity/dvws-node (its own license).

**No curated recon profile** (the UI is a single-page app whose root serves
index.html for any path — not fingerprintable). Instead, DVWS publishes an
OpenAPI spec, which recon now auto-discovers (`/openAPI-spec.json` /
`/api-docs`), yielding the full `/api/v2/*` endpoint surface for the exploit +
`--verify` agents. Builds from source (+ mongo + mysql):

```sh
git clone https://github.com/snoopysecurity/dvws-node
cd dvws-node
docker compose up -d                 # builds app on :80, + mongo + mysql
until curl -sf http://localhost/openAPI-spec.json >/dev/null; do sleep 3; done

pentestswarm scan http://localhost --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker compose down -v
```

If host port 80 is taken, remap it (edit the compose `ports:` to e.g.
`127.0.0.1:8086:80`) and scan `http://localhost:8086`.