Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
awesome-websocket-security — Awesome information for WebSockets security research | Kitploit
Tools/GitHubGitHub/palindromelabs/awesome-websocket-security
Vulnerability AnalysisWeb Application ExploitationWeb SecurityFuzzingPapers & ResearchCurated ResourcesLabs & Practice
GitHubpalindromelabs/awesome-websocket-security

awesome-websocket-security

Awesome information for WebSockets security research

View Repository
31133164 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Awesome WebSockets Security

Awesome

A collection of CVEs, research, and reference materials related to WebSocket security

Contents

  • WebSocket Library Vulnerabilities
  • Conference Talks
  • Common WebSocket Weaknesses
  • WebSocket Security Tools
  • Bug Bounty Writeups
  • Useful blog posts

WebSocket Library Vulnerabilities

This list of vulnerabilities attempts to capture WebSocket CVEs and related issues in commonly encountered WebSockets server implementations.

CVE IDVulnerable packageRelated writeupVulnerability summary
CVE-2021-42340TomcatApache mailing listDoS memory leak
CVE-2021-33880Python websocketsGitHub AdvisoryHTTP basic auth timing attack
CVE-2021-32640wsGitHub AdvisoryRegex backtracking Denial of Service
CVE-2020-36406uWebSocketsOSS Fuzz SummaryStack buffer overflow
CVE-2020-27813GorillaGitHub AdvisoryInteger overflow
CVE-2020-24807socket.io-fileAuxilium SecurityFile type restriction bypass
CVE-2020-15779socket.io-fileAuxilium SecurityPath traversal
CVE-2020-15134faye-websocketGitHub advisoryLack of TLS certificate validation
CVE-2020-15133faye-websocketGitHub advisoryLack of TLS certificate validation
CVE-2020-11050Java WebSocketGitHub advisorySSL hostname validation not performed
CVE-2020-7663Ruby websocket-extensionsWriteupRegex backtracking Denial of Service
CVE-2020-7662npm websocket-extensionsWriteupRegex backtracking Denial of Service
NoneSocket.ioGitHub IssueCORS misconfiguration
CVE-2018-1000518Python websocketsGitHub PRDoS via memory exhaustion when decompressing compressed data
NoneTornadoGitHub PRDoS via memory exhaustion when decompressing compressed data
CVE-2018-21035Qt WebSocketsBug reportDenial of service due large limit on message and frame size
CVE-2017-16031socket.ioGitHub IssueSocket IDs use predictable random numbers
CVE-2016-10544uWebSocketsnpm advisoryDenial of service due to large limit on message size
CVE-2016-10542NodeJS wsnpm advisoryDenial of service due to large limit on message size
Nonedraft-hixie-thewebsocketprotocol-76Writeup

Conference Talks, Papers, Notable Blog Posts

2011

  • Talking to Yourself for Fun and Profit Paper

2012

  • Blackhat 2012 - Mike Shema, Sergey Shekyan, Vaagn Toukharian - Hacking with WebSockets Video

2019

  • Hacktivity 2019 - Mikhail Egorov - What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs Video
  • DerbyCon 2019 - Michael Fowl, Nick Defoe - Old Tools New Tricks Hacking WebSockets Video

2021

  • OWASP Global AppSec US 2021 - Erik Elbieh - We’re not in HTTP anymore: Investigating WebSocket Server Security Tool Paper Video

Common WebSocket Weaknesses

Unencrypted WebSockets

  • Black Hills WebSocket testing guide: Link

Cross-Site WebSocket Hijacking (CSWSH)

  • Original CSWSH blog post by Christian Schneider: Link
  • PortSwigger Web Academy CSWSH lab: Link

Insecure Authentication Mechanism

  • Stratum Security blog post: Link
  • Heroku WebSocket Security: Link
Download Tool