NodeXP: NOde.js server-side JavaScript injection vulnerability DEtection and eXPloitation

Web applications are widely used, and new ways for easier cost-effective methods to develop them constantly introduced. A common omission among the development implementation techniques when designing is security; Node.js no exception, as Server-Side JavaScript Injection (SSJI) attacks possible due use of vulnerable functions neglecting sanitize data input provided by untrusted sources. This specific kind injection attack stands out because it has potential compromise servers, where code executed. In this work, we fill a significant gap in literature introducing NodeXP, which, best our knowledge, first methodology (presented software tool) that detects automatically exploits SSJI vulnerabilities. Beyond capabilities current state-of-the-art tools, NodeXP uses obfuscation methods, making more stealth adaptive needs red teaming. To end, provide thorough analysis foundation upon which they rely on, along with concrete examples facilitate reader comprehend underlying concepts. Finally, evaluate compare its peers, discuss efficacy.