What problem does it solve? WebSocket channels often bypass the security scrutiny applied to REST APIs, leaving handshake validation, origin checks, and message handling untested. This Skill provides a structured methodology for auditing WebSocket implementations during authorized penetration tests and CTF engagements. ## Core Features & Use Cases - Handshake and CSWSH Analysis: Verify Origin validation, cookie SameSite behavior, and session binding to detect cross-site WebSocket hijacking, with step-by-step exploitation patterns for lab environments. - Tooling Workflows: Covers wsrepl with auth plugins, ws-harness for bridging WebSocket to HTTP tools like sqlmap, and Burp extensions such as SocketSleuth and WebSocket Turbo Intruder. - Advanced Attack Coverage: Documents WebSocket smuggling through reverse proxies, Socket.IO namespace and event injection, binary message manipulation (Protobuf, MessagePack), and stored XSS via message broadcast. - Use Case: During an authorized assessment of a chat application, identify the wss:// endpoint, confirm the server accepts a forged Origin header, then demonstrate session hijacking by reading and writing messages as the victim user. ## Quick Start Use the websocket-security skill to test the target's WebSocket endpoint at wss://target.example.com/ws for missing Origin validation and CSWSH exposure.
