Hunt Websocket
Hunt WebSocket vulnerabilities, Cross-Site WebSocket Hijacking (CSWSH), missing/weak...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-websocket -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt WebSocket vulnerabilities, Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.
HUNT-WEBSOCKET, WebSocket Security
Crown Jewel Targets
CSWSH (Cross-Site WebSocket Hijacking) with a cookie-authenticated handshake and no CSRF/per-connection token = High, Critical (real-time exfil of any logged-in victim's data).
Highest-value chains:
- CSWSH → data exfil / ATO, handshake authenticates via ambient cookie, no CSRF token, Origin not enforced → attacker page opens WS as the victim and streams their messages/PII/tokens. If the stream carries a session/refresh/CSRF token, this escalates to ATO.
- No per-message auth, HTTP/handshake auth present but individual WS frames are not re-authorized → privileged messages accepted (
deleteUser,getSecretConfig). - Message tampering, modify in-flight frames (price, qty, userId, amount) in trading/game/checkout apps → financial fraud.
- socket.io namespace / room authz bypass, connect to a privileged namespace or join another user's room without a permission check → cross-tenant real-time exfil.
- Handshake-layer Upgrade smuggling, a malformed
Upgrade/Connection/Sec-WebSocket-*handshake makes the front proxy and origin disagree on whether an upgrade occurred → request-smuggling tunnel.
Grounding, Reference Cases (read before hunting)
These are public, verifiable references. Use them to calibrate what a real WS finding looks like and how it was proven. Do not invent additional report IDs or payouts.
