# OWASP NodeGoat — practice target

NodeGoat is OWASP's intentionally-vulnerable Express/MongoDB app demonstrating
the OWASP Top 10 in Node. Project: https://github.com/OWASP/NodeGoat (Apache-2.0).

It **is** a one-command `--lab` target: the multi-arch `rbrayner/nodegoat` image
(native arm64 + amd64) is paired with a one-container Mongo, and recon
fingerprints it via `internal/agent/recon/apiprofile_nodegoat.go`:

```sh
pentestswarm scan --lab --lab-target nodegoat --verify --follow
```

Run it yourself instead:

```sh
git clone https://github.com/OWASP/NodeGoat
cd NodeGoat
docker compose up -d            # builds node app + mongo; app on :4000
until curl -sf http://localhost:4000/login >/dev/null; do sleep 3; done

pentestswarm scan http://localhost:4000 --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker compose down -v
```

NodeGoat is **cookie-session** based (no bearer token): register at `/signup`,
login sets `connect.sid`. Headline flaws the profile points at: IDOR on
`/allocations/:userId`, server-side JS injection on `/contributions` (eval),
open redirect / SSRF on `/learn?url=`, and stored XSS on `/profile` and `/memos`.