vapt-websocket

WebSocket Security Testing

When Invoked

The user runs /vapt websocket <url> for WebSocket-specific security testing.

Phase 1: WebSocket Discovery

1.1 Endpoint Detection

# Check for WebSocket upgrade support
curl -sI -H "Upgrade: websocket" -H "Connection: Upgrade" \
    -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
    -H "Sec-WebSocket-Version: 13" <url>

# Common WebSocket paths
for path in /ws /wss /websocket /socket /socket.io /sockjs /cable /hub /realtime /live /stream /events; do
    code=$(curl -s -o /dev/null -w "%{http_code}" \
        -H "Upgrade: websocket" -H "Connection: Upgrade" \
        -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
        -H "Sec-WebSocket-Version: 13" <url>$path)
    [ "$code" = "101" ] && echo "WebSocket: $path (101 Switching Protocols)"
    [ "$code" = "200" ] && echo "Socket.IO/SockJS candidate: $path (200)"
done

1.2 Protocol Detection

Identify the WebSocket framework:

• Raw WebSocket (ws://)
• Socket.IO (transport negotiation, JSON-wrapped messages)
• SockJS (HTTP fallback, iframe transport)
• ActionCable (Rails WebSocket)
• SignalR (.NET real-time)

1.3 Transport Analysis

# Check if Socket.IO is in use
curl -s "<url>/socket.io/?EIO=4&transport=polling"

# Check SockJS
curl -s "<url>/sockjs/info"

Phase 2: Authentication & Authorization

2.1 Unauthenticated Connection

Attempt to establish a WebSocket connection without any authentication:

# Python test script (using websockets library if available)
# Alternatively describe the manual test with websocat or wscat

Using websocat (if installed):

echo '{"type":"ping"}' | websocat ws://<domain>/ws

Using wscat (if installed):

wscat -c ws://<domain>/ws

If connection succeeds without auth -> finding.

2.2 Token Validation

Test if the WebSocket validates tokens after initial connection:

1. Connect with valid token
2. Wait for token expiration
3. Check if messages still flow (should be disconnected)