What problem does it solve? WebSocket endpoints often skip the security controls applied to HTTP routes, leaving real-time features exposed to hijacking, tampering, and cross-tenant data leaks that standard web scanners miss. ## Core Features & Use Cases - CSWSH Detection: Validates Cross-Site WebSocket Hijacking with a three-condition model (ambient cookie auth, no per-connection token, no Origin enforcement) and requires out-of-band proof via Burp Collaborator. - Message-Layer Testing: Checks for missing per-message authorization, frame tampering on financial values, and socket.io/SignalR/Phoenix namespace and room authorization bypasses. - Handshake Smuggling: Probes Upgrade-header desync between front proxies and origins using HTTP Request Smuggler techniques. - Use Case: During an authorized bug bounty engagement against a trading platform, use this Skill to discover its socket.io endpoint, join a privileged namespace as a low-privilege user, and confirm cross-tenant event leakage with verifiable evidence. ## Quick Start Use the hunt-websocket skill to enumerate and test the WebSocket endpoints on my authorized target for CSWSH and message authorization flaws.
