WebSocket hunting
Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe. Cookie plus missing Origin is CSWSH.
Playbooks
- WebSocket Hunting - Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe.
Gadgets
- IDOR parameter - The param is inventory until you prove a second user can read or write the object.
- WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
Payloads
- WebSocket - Handshake and first-frame probes. Swap in a victim cookie / Origin to test CSWSH and channel IDORs.
Checklists
- WebSockets - Handshake, first frame, then every subscribe. Treat it as an API with a worse auth story.
Workflows
- WebSocket channel authorization - Verify handshake origin, token binding, subscription authorization, and unsubscribe behavior using two test accounts. Subscribe only to channels and messages created for the assessment.
Questions
What is CSWSH?
Cross-site WebSocket hijack: a foreign page opens the socket as the victim because the handshake uses a cookie and does not check Origin.
GraphQL subscriptions?
Same tests. Channel names that are user IDs are IDORs.
This page is the public form of hunt_brief("websocket") on the MCP connector. Authorized testing only.