websockets

WebSockets Detection

Overview

A WebSocket is a long-lived, bidirectional channel that begins life as an ordinary HTTP request — the handshake — and is then upgraded, after which either side may push messages at any time. Two properties make it its own review problem. First, the connection's entire security context is decided once, at the handshake, and every later message inherits it. Second, the browser API that opens a connection is not restrained by the same-origin rules that govern ordinary cross-origin reads, so any page can attempt a connection carrying the victim's ambient cookies; if the server does not check the origin or require an unguessable value, the attacker's page obtains a two-way channel inside the victim's session. The attacker is therefore either a user tampering with the messages their own client sends, or a remote page in the victim's browser. What they gain is actions performed as the victim plus a readable reply stream, or the impact of whatever sink a message reaches. This skill finds such gaps by locating every handshake and message handler, verifying each one in parallel, and merging the results into <output_dir>/websockets-results.md.

What it is NOT

• Ordinary request forgery (/websec:csrf): a cross-site request whose response the attacker cannot read. Test: if the attacker's page can read the server's replies, it belongs here; if the abuse is fire-and-forget over plain HTTP, it belongs there.
• Cross-origin resource sharing (/websec:cors): the header protocol governing cross-origin reads of HTTP responses. It does not apply to the socket API — which is precisely why the server must check the origin itself. A missing sharing header is not a socket finding, and a permissive one does not by itself make a socket hijackable.
• The sink's own class (/websec:sql-injection, /websec:os-command-injection, /websec:xss, /websec:dom-based, /websec:xxe): what a payload does once it reaches a query, a shell, a parser, or the document. Judge the socket path's failure to validate or gate here, and name the sink's own class in one line under "Also observed" so the owning skill can classify it.
• Authorization on an established connection (/websec:access-control): when the handshake is properly gated and identity is sound, a missing per-action ownership check is authorization. A message handler that performs a privileged action without re-checking anything is judged here as a connection-trust failure and noted there.
• Identity itself (/websec:authentication, /websec:jwt): how the credential presented at the handshake is proved. If a token is accepted at the handshake without validation, note it for the owning skill and judge the handshake's gating here.
• Not a finding: a cross-origin handshake that the server rejects; a socket carrying only public data with no privileged actions; the paired random-value handshake headers, which exist to stop caches and proxies from returning bogus responses and are neither an identity nor an anti-forgery control.