A dumb vulnerable Node.js application built with Express.js that exposes a /screenshot endpoint. Screenshots are realized through Puppeteer which handles browser API via a Headless Chromium instance.
- Fork this repository under your GitHub namespace
- Install dependencies
npm install - Run Docker container
docker compose up - Take a screenshot
curl -s http://localhost:80/screenshot?url=https://tidio.com - Screenshot should appear in
app/screenshotdirectory
Prepare a detailed security assessment report that documents spotted vulnerabilities, weaknesses and misconfigurations. Propose recommendations and remediations. If you are able, provide a full attack chain or at least part of it.