WebSocket hunting
Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe. Cookie plus missing Origin is CSWSH.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
- WebSockets - Handshake, first frame, then every subscribe. Treat it as an API with a worse auth story.
Disclosures
No public card yet.
Gadgets
- WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
Playbooks
- WebSocket Hunting - Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe.
Workflows
- WebSocket channel authorization - Verify handshake origin, token binding, subscription authorization, and unsubscribe behavior using two test accounts. Subscribe only to channels and messages created for the assessment.
Payloads
- WebSocket - Handshake and first-frame probes. Swap in a victim cookie / Origin to test CSWSH and channel IDORs.
Questions
What is CSWSH?
Cross-site WebSocket hijack: a foreign page opens the socket as the victim because the handshake uses a cookie and does not check Origin.
GraphQL subscriptions?
Same tests. Channel names that are user IDs are IDORs.
This page is the linked pack hunt_brief("websocket") returns on the MCP connector. Authorized testing only.