WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.

SKILL: WebSocket Security AI LOAD INSTRUCTION : This skill covers WebSocket protocol basics, cross site WebSocket hijacking (CSWSH), practical tooling bridges, and common vulnerability classes. Apply only in authorized tests; treat tokens and message content as sensitive. For REST/GraphQL companion testing, cross load [api sec](../api sec/SKILL.md) when present in the workspace. 0. QUICK START During proxy or raw traffic review, watch for: Server success response indicators: Routing note : in Burp/browser DevTools, filter for 101 and Upgrade: websocket ; for deeper API testing, align authn/authz models through api sec . 1. PROTOCOL BASICS Client request (typical) Upgrade: websocket and Connection: Upgrade — required upgrade handshake. Sec WebSocket Key — base64 nonce; server hashes with magic GUID and responds with Sec WebSocket Accept . Sec WebSocket Version: 13 — current standard version for browser interoperability. Server response HTTP/1.1 101 Switching Protocols — handshake complete; subsequent frames are WebSocket binary/text frames per RFC. Minimal conceptual flow: 2. CROSS SITE WEBSOCKET HIJACKING (CSWSH) Condition The server does not validate Origin (or equivalent binding) on the WebSocket handshake, and The victim has an active session (cookie based or browser stored creds) to the target site. Then a malicious page loaded in the victim’s browser may open a WebSocket as the victim , similar in spirit to CSRF but for a persistent bidirectional channel . Proof of concept pattern (laboratory / authorized target only) Testing notes : Confirm whether Origin is checked, whether cookies are sent ( SameSite rules), and whether subprotocol or custom headers are required—missing checks increase CSWSH risk. 3. TESTING WITH TOOLS wsrepl Use a plugin to reproduce browser cookies, headers, or token refresh during the WebSocket lifecycle. ws harness (bridge to HTTP for other tools) Example downstream use with SQL injection tooling over the bridged HTTP surface (adjust URL to local listener): Burp Suite ecosystem SocketSleuth — inspect and manipulate WebSocket traffic inside Burp. WebSocket Turbo Intruder — high rate or scripted message fuzzing. 4. COMMON VULNERABILITIES Issue Why it matters Missing Origin validation Enables CSWSH from attacker controlled pages Auth token in URL ( wss://host/ws?token=... ) Logs, proxies, Referer leakage, browser history No rate limiting on messages Abuse, brute force, DoS ws:// instead of wss:// Cleartext on the wire (MITM) Injection in message bodies SQLi, command injection, or XSS if content is stored/reflected elsewhere Example sensitive URL anti pattern: Prefer Sec WebSocket Protocol , first message auth , or cookie + CSRF token patterns aligned with product constraints. 5. DECISION TREE 1. Identify endpoint — From JS bundles, Swagger, or 101 responses; note wss vs ws . 2. Handshake review — Are Origin , Host , and Cookie policies correct? Any token in query string? 3. Session binding — Reconnect with another user’s cookie jar in Burp; compare subscription topics and data leakage. 4. CSWSH — Load a local HTML page that connects to the target with victim session active; verify server rejects wrong Origin or uses non cookie secret. 5. Message semantics — Fuzz JSON/text payloads for injection; mirror same logic as HTTP API testing. 6. Transport — Flag ws:// in production; verify TLS and HSTS alignment. 6. RELATED ROUTING From [api sec](../api sec/SKILL.md) — authentication, authorization, IDOR, and rate limiting often mirror HTTP APIs behind the same WebSocket routes. Note : WebSocket often shares session and permission models with REST; use api sec to align authentication and resource boundaries on the same backend. 7. CSWSH — STEP BY STEP EXPLOITATION Step 1: Confirm no Origin check on WS handshake Step 2: Craft attacker page Step 3: Cookies and session hijacking Step 4: Read/write messages as victim 8. WEBSOCKET SMUGGLING Concept Use the WebSocket upgrade to bypass reverse proxy restrictions, then tunnel arbitrary HTTP traffic through the WebSocket connection. Upgrade based proxy bypass H2 over WebSocket smuggling Implementation with Python Proxy specific behaviors Proxy WebSocket Tunnel Behavior Nginx Passes raw TCP after 101 — smuggling possible if backend doesn't validate WS frames HAProxy Depends on option http server close vs tunnel mode AWS ALB Terminates WebSocket — reframes traffic, harder to smuggle Cloudflare Inspects WebSocket frames — raw HTTP smuggling blocked Varnish Does not support WebSocket natively — upgrade may bypass cache entirely 9. SOCKET.IO SPECIFIC VULNERABILITIES Namespace injection Socket.IO supports namespaces ( /admin , /chat ). If authorization is only on the default namespace: Event name injection If event names are derived from user input: Acknowledgement callback abuse Socket.IO acknowledgements can return data. If the server sends sensitive data in ack callbacks: Polling fallback CSRF Socket.IO falls back to HTTP long polling when WebSocket is unavailable. The polling transport uses regular HTTP requests with cookies → susceptible to CSRF if no additional token verification: 10. WEBSOCKET MESSAGE INJECTION In intercepted connections (MITM on ws:// ) If the application uses ws:// (unencrypted), an attacker on the same network can inject messages: Application level injection When WebSocket messages are concatenated or interpolated without sanitization: Stored XSS via WebSocket 11. BINARY WEBSOCKET MESSAGE MANIPULATION Protobuf deserialization Applications using Protocol Buffers over WebSocket may be vulnerable to: MessagePack deserialization Type confusion attacks Binary serialization formats may allow type confusion: Tools for binary WebSocket analysis Tool Purpose Burp Suite + SocketSleuth Intercept and modify binary frames protobuf inspector Decode unknown protobuf structures msgpack tools Encode/decode MessagePack CLI wsdump (websocket client) Raw frame capture and replay Wireshark Dissect WebSocket frames at protocol level

websocket-security