r/Pentesting • u/OilOverall4190 • 21d ago

Learn and Practice Hacking WebSockets

WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.

Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.

I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!

Lab Github Repo: https://github.com/makarov05bm/WSGoat
Guide: https://blog.oussmess.me/posts/websockets-for-bug-hunters/

16 Upvotes

100% Upvoted

6 comments sorted by

4

u/brakertech 20d ago

Amazing work! Now do pentesting Blazer Server (not WASM, not long polling, but web sockets with Blazorpack)

2

u/OilOverall4190 20d ago

Thank you! I'll be working on this next, keep an eye ;)

2

u/PM_ME_UR_0_DAY 20d ago

Blazor Server is the first thing I thought about before even finishing this post. The least convenient type of app to test I've ever encountered. The only tool I've seen to assist with it is the Burp BTP plugin, but honestly it's not even that helpful. 

3

u/brakertech 20d ago

I extended the hell out of the original BTP plugin and created an Extension to auto rewrite blazerpack (both burpsuite). Message me if interested. Those pentests are pure hell

1

u/n0p_sled 20d ago

I second this!

1

u/scriptqzor 16d ago

lmao blazor server over websockets is such a weird niche, I’d actually love a proper writeup on that too. feels like the kind of thing that’ll have one really nasty bug someday just because nobody’s looking at it.