前期准备：
=================
这边跟windows的准备工作基本一样：
1. 下载源码：https://github.com/ajinabraham/NodeJsScan
2.下载CentOS版docker toolbox:
3.下载PostgreSQL安装详细步骤
https://www.enterprisedb.com/downloads/postgres-postgresql-downloads
https://www.pgadmin.org/
user:postgres,pw:admin,port:5432
=================
将源码减压保存如下：
[root@localhost src]# ls
debug kernels nodejsscan Python-3.8.0b3 pyvulhunter
[root@localhost src]# cd nodejsscan/
[root@localhost nodejsscan]# pwd
/usr/src/nodejsscan
先升级pip
python -m pip install --upgrade pip
安装依赖包
pip3 install -r requirements.txt
执行命令
python migrate.py # Run once to create database entries required
python app.py # Testing Environment
gunicorn -b 0.0.0.0:9090 app:app # Production Environment
-----------------
[root@localhost nodejsscan]# python app.py
* Serving Flask app "app" (lazy loading)
* Environment: production
WARNING: Do not use the development server in a production environment.
Use a production WSGI server instead.
* Debug mode: off
* Running on http://0.0.0.0:9090/ (Press CTRL+C to quit)
===========================
pip install nodejsscan
-----------------
Docker
docker build -t nodejsscan .
docker run -it -p 9090:9090 nodejsscan
-------------------
[root@localhost nodejsscan]# docker run -it -p 9090:9090 nodejsscan
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.
The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".
Data page checksums are disabled.
fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... posix
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... sh: locale: not found
No usable system locales were found.
Use the option "--debug" to see details.
ok
syncing data to disk ... ok
WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.
Success. You can now start the database server using:
pg_ctl -D /var/lib/postgresql/data -l logfile start
****************************************************
WARNING: No password has been set for the database.
This will allow anyone with access to the
Postgres port to access your database. In
Docker's default configuration, this is
effectively any other container on the same
system.
Use "-e POSTGRES_PASSWORD=password" to set
it in "docker run".
****************************************************
waiting for server to start....LOG: could not bind IPv6 socket: Address not available
HINT: Is another postmaster already running on port 5432? If not, wait a few seconds and retry.
LOG: database system was shut down at 2020-06-24 03:06:39 UTC
LOG: MultiXact member wraparound protections are now enabled
LOG: database system is ready to accept connections
LOG: autovacuum launcher started
done
server started
CREATE DATABASE
CREATE ROLE
/usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*
waiting for server to shut down....LOG: received fast shutdown request
LOG: aborting any active transactions
LOG: autovacuum launcher shutting down
LOG: shutting down
LOG: database system is shut down
done
server stopped
PostgreSQL init process complete; ready for start up.
LOG: database system was shut down at 2020-06-24 03:06:41 UTC
LOG: MultiXact member wraparound protections are now enabled
LOG: database system is ready to accept connections
LOG: autovacuum launcher started
[INFO] Table entries created!
[2020-06-24 03:06:49 +0000] [57] [INFO] Starting gunicorn 20.0.4
[2020-06-24 03:06:49 +0000] [57] [INFO] Listening at: http://0.0.0.0:9090 (57)
[2020-06-24 03:06:49 +0000] [57] [INFO] Using worker: sync
[2020-06-24 03:06:49 +0000] [60] [INFO] Booting worker with pid: 60
[2020-06-24 03:06:49 +0000] [61] [INFO] Booting worker with pid: 61
[2020-06-24 03:06:49 +0000] [62] [INFO] Booting worker with pid: 62
=========================
在另外一个控制台，进入到对应js文件目录下执行nodejsscan -d 文件夹名称
[root@localhost nodejsscan]# nodejsscan -d yourjsdir
[INFO] Running Static Analyzer on - yourjsdir
{
"files": [],
"good_finding": {},
"missing_sec_header": {
"Web Security": [
{
"description": "Content Security Policy (CSP), a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). CSP Header was not found.",
"tag": "web",
"title": "Missing Security Header - Content-Security-Policy (CSP)"
},
{
"description": "X-Frame-Options (XFO) header provides protection against Clickjacking attacks.",
"tag": "web",
"title": "Missing Security Header - X-Frame-Options (XFO)"
},
{
"description": "Strict-Transport-Security (HSTS) header enforces secure (HTTP over SSL/TLS) connections to the server.",
"tag": "web",
"title": "Missing Security Header - Strict-Transport-Security (HSTS)"
},
{
"description": "Public-Key-Pins (HPKP) ensures that certificate is Pinned.",
"tag": "web",
"title": "Missing Security Header - Public-Key-Pins (HPKP)"
},
{
"description": "X-XSS-Protection header set to 1 enables the Cross-site scripting (XSS) filter built into most recent web browsers.",
"tag": "web",
"title": "Missing Security Header - X-XSS-Protection:1"
},
{
"description": "X-Content-Type-Options header prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.",
"tag": "web",
"title": "Missing Security Header - X-Content-Type-Options"
},
{
"description": "X-Download-Options header set to noopen prevents IE users from directly opening and executing downloads in your site's context.",
"tag": "web",
"title": "Missing Security Header - X-Download-Options: noopen"
},
{
"description": "JavaScript can access Cookies if they are not marked httpOnly.",
"tag": "web",
"title": "Missing 'httpOnly' in Cookie"
},
{
"description": "Remove the X-Powered-By header to prevent information gathering.",
"tag": "web",
"title": "Information Disclosure - X-Powered-By"
}
]
},
"sec_issues": {},
"total_count": {
"good": 0,
"mis": 9,
"sec": 0
},
"vuln_count": {}
}
[root@localhost nodejsscan]#
网页版查看使用如下：
将要审计的js代码拖到上面，结果如下面：
.================
参考Windows版的链接如下：https://blog.csdn.net/weixin_34102807/article/details/86263310