<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing WebSocket Hijacking

## websocat — WebSocket Client
```bash
websocat -H "Origin: https://evil.com" wss://target.com/ws
echo '{"action":"ping"}' | websocat wss://target.com/ws
```

## wscat — Node.js WebSocket Client
```bash
wscat -c wss://target.com/ws -H "Cookie: session=TOKEN"
```

## curl — Upgrade Handshake
```bash
curl -s -D- -H "Upgrade: websocket" -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" https://target.com/ws
```
