#vulns.co
/
mcp by GKData.io

← Back to Payloads

WebSocket

Handshake and first-frame probes. Swap in a victim cookie / Origin to test CSWSH and channel IDORs.

Tags: websocket, idor, cswsh

Controlled probes

  • GET /socket.io/?EIO=4&transport=websocket HTTP/1.1
  • {"type":"subscribe","channel":"user:VICTIM_ID"}
  • {"id":"1","type":"start","payload":{"query":"subscription { messages { text } }"}}
  • Origin: https://evil.example

Source: https://portswigger.net/web-security/websockets

← Back to Payloads