JavaScript libraries are widely used in any website, and are also considered the most vulnerable components. As Using Components with Known Vulnerabilities is one of the OWASP Top 10 security issues, we will need to constantly monitor any major known vulnerable components on the web. In this demonstration, we will introduce how to scan for known vulnerabilities in JavaScript libraries.
We will be using RetireJS because it's simple to use and provides several ways of scanning, such as a command-line scanner, Grunt plugin, browser (Chrome/Firefox) extension, and also the Burp and OWASP Zap plugins. In our demonstration, we will be using the command-line scanner in the following steps.
