# Websocket API Security

WebSocket API security testing, upgrade authentication and Origin/CSWSH hijacking...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill websocket-api-security -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill websocket-api-security -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill websocket-api-security -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill websocket-api-security -g -a gemini-cli -y`

## Description

WebSocket API security testing, upgrade authentication and Origin/CSWSH hijacking, per-message authorization bypass, frame injection, token lifecycle on reconnect, and unthrottled resource consumption on the WS path

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# WebSocket API Security

## Purpose
Test real-time WebSocket APIs for handshake authorization gaps (CSWSH), message-level authorization bypass, injection inside frames, and resource-consumption weaknesses specific to the WS path.

## Preconditions
- An identified WebSocket endpoint (ws:// or wss://)
- Client tooling: Python `websockets`/`websockify`, wscat, or a raw socket script
- The victim/attacker session contexts needed for differential tests

## Attack Surface Signals
- Upgrade requests (`Connection: Upgrade`, `Sec-WebSocket-Key`)
- wss:// URLs in JavaScript bundles (often with tokens in query strings)
- Socket.io / SockJS / GraphQL-over-WS endpoints
- Channels/rooms/topics in the message protocol

## Methodology

### Step 1: Handshake and Origin (CSWSH)
```bash
# Does the server validate Origin on upgrade? Cookie-auth sockets that skip
# validation are hijackable cross-site.
for origin in "https://target.com" "https://evil.com" "null" "https://target.com.evil.com"; do
  curl -sk -i -N "https://TARGET/socket" \
    -H "Connection: Upgrade" -H "Upgrade: websocket" \
    -H "Sec-WebSocket-Version: 13" -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
    -H "Origin: $origin" | head -1
done
```
CSWSH confirmed when a connection bearing a foreign/absent Origin still receives the victim's real-time data (i.e., a cookie-authenticated session usable from attacker-controlled origins).

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/websocket-api-security/SKILL.md