<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing WebSocket Security

## websocat — WebSocket Client
```bash
# Connect to WebSocket
websocat "wss://target.com/ws"

# Connect with auth header
websocat -H "Authorization: Bearer $TOKEN" "wss://target.com/ws"

# Send single message and disconnect
websocat --one-message -H "Authorization: Bearer $TOKEN" \
  "wss://target.com/ws" <<< '{"action":"ping"}'

# Test origin validation
websocat -H "Origin: https://evil.com" "wss://target.com/ws"
```

## curl — WebSocket Upgrade Detection
```bash
# Check for WebSocket upgrade support
curl -sI -H "Upgrade: websocket" -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" https://target.com/ws

# Scan common WebSocket paths
for P in /ws /websocket /socket.io/ /realtime /live; do
  curl -s -o /dev/null -w "$P: %{http_code}\n" \
    -H "Upgrade: websocket" "https://target.com$P"
done
```

## Burp Suite — WebSocket Interception
```
1. Configure Burp as proxy for WebSocket traffic
2. WebSocket history appears in Proxy → WebSockets tab
3. Send messages to Repeater for manual testing
4. Use Intruder on individual WebSocket message fields
```

## nuclei — WebSocket Scanning
```bash
nuclei -u wss://target.com/ws -t http/vulnerabilities/websocket/ -severity high
```
