A WebSocket is a long-lived, full-duplex connection between a browser and a server. It powers the real-time features REST cannot do cleanly — chat, live dashboards, notifications, collaborative editing — and it falls under the OWASP Web Security Testing Guide section on testing WebSockets.
It begins as an HTTP request
A WebSocket connection is negotiated by an ordinary HTTP request that asks to be upgraded:
GET /chat HTTP/1.1
Host: vulnerable.example
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==
Sec-WebSocket-Version: 13
Origin: https://vulnerable.example
Cookie: session=...The server answers 101 Switching Protocols, and from that moment the connection is no longer HTTP. It carries frames in both directions at any time — the server can push to the client without being asked. The scheme is ws:// (cleartext) or wss:// (TLS).
Socket.IO — used by NovaCart to announce "challenge solved" — is a library built on top of WebSocket. It is a convenient place to watch a live stream in DevTools, which is exactly what you will do shortly.
The security idea to hold onto
- The handshake is a normal HTTP request — so it carries the victim's cookies automatically and is subject to request-forgery problems.
- The frames that follow are not individual HTTP requests — they are not re-authenticated per message, they do not carry per-request CSRF protection, and the browser's same-origin policy does not stop a malicious page from opening a WebSocket to another origin.
What you will do in this lesson
- Inspect a live WebSocket / Socket.IO stream in DevTools to understand the handshake and framing (NovaCart's notification traffic works well).
- Learn why a WebSocket message is untrusted input that can reach XSS, SQL-injection, and command-injection sinks.
- Understand and demonstrate Cross-Site WebSocket Hijacking (CSWSH) against a handshake authenticated by cookie alone.
- Learn the defences: Origin validation, a CSRF / per-session token, treating every message as untrusted, and
wss://.
Lab target — two tiers. The observation step (inspecting the live Socket.IO stream) uses the bundled NovaCart application and requires only a browser — no additional setup. The exploitation steps (message tampering and demonstrating CSWSH) require a PortSwigger Web Security Academy WebSocket lab; create a free account at portswigger.net before those steps. If PortSwigger is not yet available, complete the observation step and all quizzes now and return to the exploitation steps once the account is set up — the quizzes cover the core concepts without a live exploit target.
Estimated time: 10 to 15 minutes.
When you are ready, send the Continue signal.