Penetration Testing Basics for Developers

1// scripts/pre-pentest-check.cjs
2// Run: node scripts/pre-pentest-check.cjs https://staging.api.example.com
3const https = require('https');
4const http = require('http');
5
6const BASE = process.argv[2] || 'http://localhost:3000';
7const TOKEN = process.argv[3] || '';
8
9async function fetchUrl(url, options) {
10  return new Promise((resolve, reject) => {
11    const { headers = {}, method = 'GET', body } = options || {};
12    const parsed = new URL(url);
13    const client = parsed.protocol === 'https:' ? https : http;
14    const req = client.request(
15      { hostname: parsed.hostname, port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
16        path: parsed.pathname + parsed.search, method,
17        headers: { ...headers, 'User-Agent': 'PentestPrecheck/1.0' } },
18      (res) => {
19        let data = '';
20        res.on('data', c => data += c);
21        res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
22      }
23    );
24    req.on('error', reject);
25    if (body) req.write(body);
26    req.end();
27  });
28}
29
30let passed = 0, failed = 0;
31
32function check(name, condition, detail) {
33  const status = condition ? 'PASS' : 'FAIL';
34  if (condition) passed++; else failed++;
35  console.log('[' + status + '] ' + name + (detail ? ': ' + detail : ''));
36}
37
38async function main() {
39  console.log('=== Pre-Pentest Security Check ===');
40  console.log('Target: ' + BASE + '\n');
41
42  // Security Headers
43  console.log('--- Security Headers ---');
44  const healthRes = await fetchUrl(BASE + '/api/health');
45  const h = healthRes.headers;
46  check('X-Content-Type-Options: nosniff', h['x-content-type-options'] === 'nosniff', h['x-content-type-options']);
47  check('X-Frame-Options: DENY', h['x-frame-options'] === 'DENY', h['x-frame-options']);
48  check('No X-Powered-By', !h['x-powered-by'], h['x-powered-by'] || 'absent');
49  check('CSP present', !!h['content-security-policy']);
50  check('CSP no unsafe-inline', !h['content-security-policy']?.match(/script-src.*unsafe-inline/));
51
52  // JWT algorithm confusion
53  console.log('\n--- Authentication ---');
54  const noneToken = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url') + '.' +
55    Buffer.from(JSON.stringify({ sub: 'admin' })).toString('base64url') + '.';
56  const noneRes = await fetchUrl(BASE + '/user/profile', {
57    headers: { Authorization: 'Bearer ' + noneToken },
58  });
59  check('JWT alg:none rejected', noneRes.status === 401, 'status: ' + noneRes.status);
60
61  // Rate limiting
62  const loginAttempts = await Promise.all(
63    Array.from({ length: 15 }, () =>
64      fetchUrl(BASE + '/auth/login', {
65        method: 'POST',
66        headers: { 'Content-Type': 'application/json' },
67        body: JSON.stringify({ email: '[email protected]', password: 'wrong' }),
68      })
69    )
70  );
71  const limited = loginAttempts.filter(r => r.status === 429);
72  check('Login rate limiting (15 rapid requests)', limited.length > 0, limited.length + '/15 rate limited');
73
74  // CORS
75  console.log('\n--- CORS ---');
76  const corsRes = await fetchUrl(BASE + '/api/courses', {
77    headers: { Origin: 'https://evil-attacker.com' },
78  });
79  const acao = corsRes.headers['access-control-allow-origin'];
80  check('Evil origin not reflected', acao !== 'https://evil-attacker.com', 'ACAO: ' + (acao || 'absent'));
81
82  // Information Disclosure
83  console.log('\n--- Information Disclosure ---');
84  const errorRes = await fetchUrl(BASE + '/api/courses/not-a-valid-uuid',
85    TOKEN ? { headers: { Authorization: 'Bearer ' + TOKEN } } : {});
86  check('No stack trace in errors', !errorRes.body.match(/at Object\.|node_modules/));
87  check('No DB info in errors', !errorRes.body.match(/prisma|postgres|sql/i));
88
89  // Summary
90  console.log('\n=== Results: ' + passed + ' PASS, ' + failed + ' FAIL ===');
91  if (failed > 0) {
92    console.error('Fix FAIL items before the manual penetration test.');
93    process.exit(1);
94  }
95  console.log('Ready for manual penetration test.');
96}
97
98main().catch(err => { console.error(err); process.exit(1); });