Awesome WebSockets Security
A collection of CVEs, research, and reference materials related to WebSocket security
Contents
WebSocket Library Vulnerabilities
This list of vulnerabilities attempts to capture WebSocket CVEs and
related issues in commonly encountered WebSockets server implementations.
Conference Talks, Papers, Notable Blog Posts
2011
- Talking to Yourself for Fun and Profit Paper
2012
- Blackhat 2012 - Mike Shema, Sergey Shekyan, Vaagn Toukharian - Hacking with WebSockets Video
2019
- Hacktivity 2019 - Mikhail Egorov - What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs Video
- DerbyCon 2019 - Michael Fowl, Nick Defoe - Old Tools New Tricks Hacking WebSockets Video
2021
- OWASP Global AppSec US 2021 - Erik Elbieh - We’re not in HTTP anymore: Investigating WebSocket Server Security Tool Paper Video
Common WebSocket Weaknesses
Unencrypted WebSockets
- Black Hills WebSocket testing guide: Link
Cross-Site WebSocket Hijacking (CSWSH)
- Original CSWSH blog post by Christian Schneider: Link
- PortSwigger Web Academy CSWSH lab: Link
Insecure Authentication Mechanism
- Stratum Security blog post: Link
- Heroku WebSocket Security: Link
- Mikhail Egorov's initial PoC from Hacktivity 2019: Link
- Jake Miller's HTTP 2 smuggling tool based on Mikhail's PoC work: Link
- AssetNote blog post with golang h2smuggler tool: Link
DOM-based WebSocket-URL poisoning
- Portswigger summary: Link
Useful Blog Posts & Resources
- Portscanning using WebSockets Link
- WebSocket fuzzing with Kitty fuzzing framework Link
- WebSocket fuzzing harness Link
- Project Zero WebSockets-based buffer overflow Link
- Reserved Extension, Subprotocol values Link
Discovery, Fingerprinting, Vulnerability Detection
Fuzzing
Playgrounds
- DVWS: A purposefully vulnerable WebSocket demo GitHub
- WebSocket-Playground: Jumpstart multiple WebSockets servers GitHub
Bug Bounty Writeups
CSWSH bugs
Other bugs
palindromelabs/awesome-websocket-security
