skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-websocket

Detect WebSocket vulnerabilities including CSWSH, message tampering, and authorization bypasses.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#pentesting#websocket#recon#cswsh
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-websocket-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-websocket
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-websocket
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-websocket-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of auditing complex, stateful WebSocket communications for vulnerabilities like Cross-Site WebSocket Hijacking (CSWSH) and authorization bypasses that traditional scanners often miss.

Core Features & Use Cases

  • CSWSH Detection: Validates if WebSocket handshakes are vulnerable to cross-origin hijacking by testing ambient credential usage and origin enforcement.
  • Message Authorization Auditing: Identifies missing per-message authentication where privileged actions are accepted without re-validation.
  • Use Case: Use this skill to test a real-time trading platform or chat application to ensure that an attacker cannot hijack a user's session or perform unauthorized actions by manipulating WebSocket frames.

Quick Start

Use the hunt-websocket skill to probe the target application for WebSocket endpoints and test them for potential CSWSH and message tampering vulnerabilities.

Frequently Asked Questions about hunt-websocket

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for Cross-Site WebSocket Hijacking in a real-time web application?▼

CSWSH detection involves probing WebSocket handshakes to test ambient credential usage and verify strict origin enforcement, preventing cross-origin hijacking in real-time web applications.

What is the best way to audit WebSocket message tampering and authorization bypasses?▼

Auditing message tampering and authorization bypasses requires validating per-message authentication, ensuring privileged actions cannot execute without re-validation, and manually confirming out-of-band impact on the target system.

Does this WebSocket vulnerability testing method work with socket.io and SignalR?▼

Yes, this vulnerability testing method applies to real-time web applications, chat systems, and trading platforms using protocols like socket.io and SignalR to uncover stateful communication flaws.

Why do traditional scanners miss WebSocket vulnerabilities like CSWSH?▼

Traditional scanners often miss CSWSH and authorization bypasses because auditing complex, stateful WebSocket communications requires manual verification of handshake authentication and frame-level authorization logic.

How do I validate missing per-message authentication in WebSocket frames?▼

To validate missing per-message authentication, you manipulate WebSocket frames to check if the server accepts privileged actions without re-validating user authorization, confirming the vulnerability through out-of-band impact verification.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

h2c-websocket-smuggling

Bypass reverse proxy ACLs and WAF rules via H2C and WebSocket smuggling.

Official
Intermediate
devtintdevtint

privilege-escalation

Tests API authorization for vertical, horizontal, and role-bypass privilege escalation vulnerabilities.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate