What problem does it solve? WebSocket endpoints are often overlooked during security testing, leaving real-time features like chat, notifications, and trading platforms exposed to hijacking, tampering, and cross-tenant data leaks. This Skill provides a structured methodology to find and validate WebSocket vulnerabilities during authorized bug bounty hunting. ## Core Features & Use Cases - CSWSH Detection: Test for Cross-Site WebSocket Hijacking by validating the three required conditions (cookie-authenticated handshake, no per-connection token, missing Origin enforcement) with a real attacker-origin PoC and out-of-band exfiltration proof. - Message-Layer Testing: Probe for missing per-message authentication, signed-message replay, state machine bypasses, and tampering of financial values like price, amount, and userId. - Protocol-Specific Attacks: Test socket.io namespace and room authorization bypasses, SignalR hub method authorization, Phoenix Channels topic joins, and handshake-layer Upgrade smuggling between proxies and origins. - Use Case: While testing a trading platform's bug bounty program, you discover a wss:// endpoint, confirm the handshake relies only on cookies, and prove CSWSH by receiving a separate victim account's data in an attacker-hosted page with OAST confirmation. ## Quick Start Ask the AI to hunt for WebSocket vulnerabilities on your authorized bug bounty target, starting with endpoint discovery and CSWSH testing.
