I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration testing on this application or what should I do after gathering information about the application?

I have tried to intercept the request and response using Burp and it seems like the application is using websockets to exchange data. I haven't seen such a method before.

If there are any tools that you think can help please let me know (Like JSON Beautifier, or vuln. scanner).


There isn't anything brilliant for web application testing with web sockets. Last time I tried, ZAP (https://www.zaproxy.org/) offered a better alternative to burpsuite, but I know that portswigger have since improved this aspect.

Like any other web application, you need to worry about user input, requests to the server, responses, etc. Consider the same layers of implementation where vulnerabilities could exist in: configuration, authentication, access controls, session management, input validation... https://owasp.org/www-project-web-security-testing-guide/stable/ https://owasp.org/www-project-top-ten/

  • can you give some example scenario of access controls? I've observed that the functions in the application sent to the client by the server right after login, so if the server didn't send the function to the client, there is nothing that client can do to access the restricted functions, am I right? – WangChuu Apr 30 '20 at 3:11
  • there is only one way to find out. intercept those comms, change them, act on those and see what happens. if the server says user is not super user and therefore certain screens won't be visible, this does not mean the actions on those screens would not work if executed by the user. – Pedro Apr 30 '20 at 9:11

First You need to understand Websocket mechanism Refer this link (https://portswigger.net/web-security/websockets#intercepting-and-modifying-websocket-messages)

After that you have to configure Burpsuite to Intercept Websocket communication Refer this link (https://portswigger.net/burp/documentation/desktop/tools/proxy/options#intercepting-websocket-messages)

You can refer below mentioned Book for more detail understanding of Websocket Security testing. (https://www.theseus.fi/bitstream/handle/10024/113390/Harri+Kuosmanen+-+Masters+thesis+-+Security+Testing+of+WebSockets+-+Final.pdf?sequence=1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.