Websocket API Security
WebSocket API security testing, upgrade authentication and Origin/CSWSH hijacking...
Install
npx skills add xalgorix/xalgorix --skill websocket-api-security -g -a claude-code -y- Repository
- xalgorix/xalgorix1.3k
- Category
- Testing
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,339 tokens
- Runs scripts
- No, instructions only
What it does
WebSocket API security testing, upgrade authentication and Origin/CSWSH hijacking, per-message authorization bypass, frame injection, token lifecycle on reconnect, and unthrottled resource consumption on the WS path
WebSocket API Security
Purpose
Test real-time WebSocket APIs for handshake authorization gaps (CSWSH), message-level authorization bypass, injection inside frames, and resource-consumption weaknesses specific to the WS path.
Preconditions
- An identified WebSocket endpoint (ws:// or wss://)
- Client tooling: Python
websockets/websockify, wscat, or a raw socket script - The victim/attacker session contexts needed for differential tests
Attack Surface Signals
- Upgrade requests (
Connection: Upgrade,Sec-WebSocket-Key) - wss:// URLs in JavaScript bundles (often with tokens in query strings)
- Socket.io / SockJS / GraphQL-over-WS endpoints
- Channels/rooms/topics in the message protocol
Methodology
Step 1: Handshake and Origin (CSWSH)
# Does the server validate Origin on upgrade? Cookie-auth sockets that skip
# validation are hijackable cross-site.
for origin in "https://target.com" "https://evil.com" "null" "https://target.com.evil.com"; do
curl -sk -i -N "https://TARGET/socket" \
-H "Connection: Upgrade" -H "Upgrade: websocket" \
-H "Sec-WebSocket-Version: 13" -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
-H "Origin: $origin" | head -1
done
CSWSH confirmed when a connection bearing a foreign/absent Origin still receives the victim's real-time data (i.e., a cookie-authenticated session usable from attacker-controlled origins).
