WebSocket Hunting
Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe.
Tags: websocket, idor, cswsh
Level: intermediate
Method
Find the sockets
JS new WebSocket, socket.io, graphql-ws, SockJS. Note whether the token is in the query, a cookie, or a first JSON frame.
Tools: katana, jsluice, Burp Suite
Replay as the other user
Capture A's subscribe, replay as B. Channel names that are user IDs are IDORs.
Tools: Burp Suite, Caido
Cross-site hijack
If the handshake uses a cookie and Origin is not checked, a foreign page can open the socket as the victim (CSWSH).
Server messages as HTML
If the client renders WS payloads with innerHTML, you have stored XSS with a broadcast amplifier.
Field notes
- Burp's WebSockets tab plus Repeater is enough. Match/replace the auth frame.
- GraphQL subscriptions are WebSockets with nicer names. Same IDOR tests.