<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-web-socket-hijacking
description: >-
  Test WebSocket implementations for cross-site WebSocket hijacking
  (CSWSH), missing origin validation, authentication token leakage,
  injection attacks through WebSocket messages, and insecure upgrade
  handshake handling.
domain: cybersecurity
subdomain: application-security
tags:
  - websocket
  - cswsh
  - hijacking
  - real-time
  - owasp-a01
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1185"]
  owasp-top10: ["A01"]
  tools: ["websocat", "burpsuite", "curl", "wscat"]
---

# Testing WebSocket Hijacking

## Overview

WebSocket connections bypass standard CORS protections and may be vulnerable
to cross-site hijacking if the server does not validate the Origin header
during the upgrade handshake. Attackers can establish WebSocket connections
from malicious pages, steal data, and inject commands using the victim's
authenticated session.

## Prerequisites

- Tools: websocat, wscat, Burp Suite, curl
- Target with WebSocket endpoints
- Browser developer tools (Network > WS tab)

## Workflow

### Step 1: Identify WebSocket Endpoints

```bash
# Check for WebSocket upgrade
curl -s -D- -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" \
  https://target.com/ws

# Search JavaScript for WebSocket connections
curl -s https://target.com/app.js | grep -oE "wss?://[^'\"\\s]+"
```

### Step 2: Test Origin Validation

```bash
# Connect with legitimate origin
websocat -H "Origin: https://target.com" wss://target.com/ws

# Connect with malicious origin
websocat -H "Origin: https://evil.com" wss://target.com/ws

# Connect with null origin
websocat -H "Origin: null" wss://target.com/ws

# If connection succeeds with evil origin -> CSWSH vulnerable
```

### Step 3: Message Injection Testing

```bash
# Connect and test message injection
wscat -c wss://target.com/ws -H "Cookie: session=TOKEN"

# Send crafted messages:
# > {"action":"admin_command","cmd":"delete_user","id":1}
# > <script>alert(1)</script>
# > {"__proto__":{"isAdmin":true}}
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Cross-origin WebSocket upgrade | Proxy logs | Origin header mismatch on WS handshake |
| Unusual WebSocket message patterns | Application logs | Injection payloads in WS messages |
| High-volume WS connections | Rate limiting | Brute force via WebSocket batching |

```yaml
title: Testing Web Socket Hijacking Detection
id: 74144d75-08f7-49f4-b96e-061c78262f27
status: experimental
description: Detects suspicious activity related to testing web socket hijacking techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1185
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] WebSocket endpoints enumerated
- [ ] Origin validation tested with cross-origin requests
- [ ] Authentication verified for WebSocket connections
- [ ] Message injection tested (XSS, SQLi, command injection)
- [ ] Rate limiting applied to WebSocket messages
- [ ] TLS enforced (wss:// not ws://)

## References

- [PortSwigger WebSocket Security](https://portswigger.net/web-security/websockets)
- [Cross-Site WebSocket Hijacking](https://christian-schneider.net/CrossSiteWebSocketHijacking.html)
- [OWASP WebSocket Testing](https://owasp.org/www-project-web-security-testing-guide/)
