makarov05bm/wsgoatThe vulnerable application that will teach you how to hack WebSockets
A deliberately vulnerable, Dockerized WebSocket application designed for learning and practicing WebSocket security testing in a controlled environment.
The lab implements a realistic web application with authentication, private messaging, user profiles, and multiple WebSocket endpoints. Each feature provides an opportunity to study how WebSocket-specific vulnerabilities arise when authentication, authorization, and application-level security controls are incorrectly implemented.
docker compose up --build
Open:
Create two accounts in two browser profiles/incognito windows.
Example:
User A:
alicepassword123User B:
bobpassword123Each account receives an 8-character user code.
Enter Bob's code from Alice's session. Enter Alice's code from Bob's session. The two clients will join the same conversation.
I wrote a walkthough of the bugs present in the lab, and it will be updated regularily.
I also encourage you to watch this talk from OWASP
and this video from BBRE