7

WebSockets have some potential new vulnerabilities, such as Cross-Site WebSocket Hijacking.

Is there a vulnerable app (like Damn Vulnerable Web App, HackMeBank) that demonstrates WebSocket vulnerabilities?

  • 1
    Interesting. Perhaps an additionally pertinent question is whether that attack is still current since that blog post was from 2013. – Julian Knight Sep 29 '16 at 15:57
  • @JulianKnight - If we had a demo app, we could test it easily :) – paj28 Sep 29 '16 at 16:25
  • Ha! Good point, well made :) I'd already upvoted your question though so I can't do it again I'm afraid. Hopefully, someone with more knowledge in this area will wade in. – Julian Knight Sep 29 '16 at 16:31
  • @JulianKnight - There are a few issues with the demo app someone provided here (without a login, it's too simple to do real PoCs), but initial indications are that WebSocket Hijacking still works in latest Chrome. – paj28 Sep 30 '16 at 12:33
  • Thanks for letting us know and thanks for raising the question, very helpful. Not good that it is still present. Need to give some thought about mitigation in some projects. – Julian Knight Sep 30 '16 at 14:43
2

You should check out OWASP's Damn Vulnerable Web Sockets

To install docker container docker pull tssoffsec/dvws

to run, docker run -d -p 80:80 -p 8080:8080 tssoffsec/dvws

  • Thanks, I finally tried it out, definitely the best one I've tried – paj28 Oct 9 '17 at 13:25
3

I think this is what you are looking for: Analysing, Testing and Fuzzing WebSocket Implementations with IronWASP. Looks like it has a nice set of tools for training and getting started with Web Socket Security. I stumbled upon this a few days ago but didn't get a chance to actually try their demo out. Just to give a summary of that blog post -- the author has added 5 new tools to IronWASP (an Open Source Advanced Web Security Testing Platform) dedicated to Web Socket testing:

1) WebSocket Message Analyzer: An utility to analyse complex WebSocket implementations in a simple way. Check out this report of of our WebSocket Demo Application.

2) Online Cross-Site WebSocket Hijacking Tester: An online tool to easily check for CSWSH issues. Check it out here. To understand more about Cross-Site WebSocket Hijacking check out this post on NotSoSecure

3) WebSocket Client: Versatile WebSocket client that lets you send store and send multiple messages along with setting custom Origin and Cookie headers. Perfect for checking Cross-Site WebSocket Hijacking and other WebSocket issues.

4) WebSocket Scripting API for Python and Ruby: To automated checks and write custom fuzzers for WebSocket implementations. Generic fuzzers don't work for asynchronous protocols like WebSockets.

5) WebSocket Demo App: A sample vulnerable application that is built to use WebSockets heavily. Good test bed to test and learn WebSocket security testing.

Again, I haven't had a chance to try these out yet, but this one looked interesting.

Please feel free to share any other resources you guys may have in comments, answers or even by adding them to my post. It'd be nice to have a comprehensive list of resources for training purpose. Here are some other resources on Web Socket Security:

  • Thanks for this. I'd not seen IronWASP before, which is interested. The app is the only vulnerable WebSockets app I've seen. Turns out it's not a brilliant demo app, but it's a start. So thanks :) – paj28 Oct 3 '16 at 18:05
  • Yeah, I thought so. Maybe you can develop something brilliant while you are doing your research and update my answer with your vulnerable app. ;) – Rahil Arora Oct 3 '16 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.