NodeJsScan

Static security code scanner (SAST) for Node.js applications.

Configure & Run NodeJsScan

Install Postgres and configure SQLALCHEMY_DATABASE_URI in core/settings.py

pip3 install -r requirements.txt
python3 migrate.py # Run once to create database entries required
python3 app.py # Testing Environment
gunicorn -b 0.0.0.0:9090 app:app --workers 3 --timeout 10000 # Production Environment

This will run NodeJsScan on http://0.0.0.0:9090

If you need to debug, set DEBUG = True in core/settings.py

Command Line Interface and Python API

• CLI: https://github.com/ajinabraham/njsscan#command-line-options
• API: https://github.com/ajinabraham/njsscan#python-api

Docker

NodeJsScan Docker images can be built for both the Web UI and CLI version.

docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan

• CLI: https://github.com/ajinabraham/njsscan#build-locally

DockerHub

Prebuilt Docker images are available from DockerHub.

docker pull opensecurity/nodejsscan
docker run -it -p 9090:9090 opensecurity/nodejsscan:latest

• CLI: https://github.com/ajinabraham/njsscan#prebuilt-image-from-dockerhub

Learn Node.js Security: Pentesting and Exploitation

NodeJsScan Web UI

Static Analysis