hunt-websocket

What problem does it solve?

This skill solves the problem of missed WebSocket vulnerabilities during standard web penetration tests, providing a structured, validated workflow to identify high-impact flaws like cross-site WebSocket hijacking, missing per-message authentication, and framework-specific authorization bypasses that could lead to account takeover, data theft, or financial fraud.

Core Features & Use Cases

• Validated CSWSH Testing: Detects cross-site WebSocket hijacking flaws where ambient cookie authentication and missing Origin checks allow attackers to stream victim data or send privileged actions as the victim, with mandatory out-of-band proof requirements to eliminate false positives.
• Message Layer Security Validation: Tests for missing per-message authentication on authenticated WebSocket connections, in-flight message tampering for transactional apps (trading, checkout, gaming), and privileged action abuse that could lead to unauthorized data modification or deletion.
• Framework-Specific Enumeration: Includes targeted testing for socket.io, SignalR, and Phoenix Channels namespace/room authorization bypasses, plus handshake-layer HTTP upgrade smuggling detection to bypass front-end WAF and authorization controls.
• Use Case: For a real-time collaboration platform with WebSocket-based chat and file sharing, use this skill to confirm CSWSH flaws that allow attackers to exfiltrate private user messages, and validate namespace bypasses that expose cross-tenant sensitive data.

Quick Start

Use the hunt-websocket skill to test the WebSocket endpoints at wss://your-target-domain.com/ws for cross-site hijacking, missing message authentication, and message tampering vulnerabilities, then generate a validated bug bounty report with proof of impact.