awesome-websocket-security

WebSocket security info

A collection of resources and research on vulnerabilities and security best practices for WebSockets

Awesome information for WebSockets security research

GitHub

254 stars
12 watching
26 forks
last commit: over 4 years ago
Linked from 1 awesome list

securitysecurity-toolsweb-application-securitywebsocketwebsocket-securitywebsocketswebsockets-security

Awesome WebSockets Security / WebSocket Library Vulnerabilities

CVE-2021-42340
Tomcat17,520almost 2 years ago
Apache mailing list
CVE-2021-33880
Python websockets5,242almost 2 years ago
GitHub Advisory
CVE-2021-32640
ws21,839almost 2 years ago
GitHub Advisory21,839almost 2 years ago
CVE-2020-36406
uWebSockets17,520almost 2 years ago
OSS Fuzz Summary138almost 2 years ago
CVE-2020-27813
Gorilla22,625about 2 years ago
GitHub Advisory22,625about 2 years ago
CVE-2020-24807
socket.io-file48almost 7 years ago
Auxilium Security
CVE-2020-15779
socket.io-file48almost 7 years ago
Auxilium Security
CVE-2020-15134
faye-websocket1,040about 3 years ago
GitHub advisory4,393about 2 years ago
CVE-2020-15133
faye-websocket1,040about 3 years ago
GitHub advisory1,040about 3 years ago
CVE-2020-11050
Java WebSocket
GitHub advisory10,557almost 2 years ago
CVE-2020-7663
Ruby websocket-extensions
Writeup
CVE-2020-7662
npm websocket-extensions
Writeup
Socket.io61,369almost 2 years ago
GitHub Issue61,369almost 2 years ago
CVE-2018-1000518
Python websockets5,242almost 2 years ago
GitHub PR5,242almost 2 years ago
Tornado21,787almost 2 years ago
GitHub PR21,787almost 2 years ago
CVE-2018-21035
Qt WebSockets
Bug report
CVE-2017-16031
socket.io
GitHub Issue61,369almost 2 years ago
CVE-2016-10544
uWebSockets17,520almost 2 years ago
npm advisory
CVE-2016-10542
NodeJS ws
npm advisory
draft-hixie-thewebsocketprotocol-76
Writeup

Awesome WebSockets Security / 2011

PaperTalking to Yourself for Fun and Profit

Awesome WebSockets Security / 2011 / 2012

VideoBlackhat 2012 - Mike Shema, Sergey Shekyan, Vaagn Toukharian - Hacking with WebSockets

Awesome WebSockets Security / 2011 / 2019

VideoHacktivity 2019 - Mikhail Egorov - What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs
VideoDerbyCon 2019 - Michael Fowl, Nick Defoe - Old Tools New Tricks Hacking WebSockets

Awesome WebSockets Security / 2011 / 2021

Tool337over 4 years agoOWASP Global AppSec US 2021 - Erik Elbieh - We’re not in HTTP anymore: Investigating WebSocket Server Security

Awesome WebSockets Security / Common WebSocket Weaknesses / Unencrypted WebSockets

LinkBlack Hills WebSocket testing guide:

Awesome WebSockets Security / Common WebSocket Weaknesses / Cross-Site WebSocket Hijacking (CSWSH)

LinkOriginal CSWSH blog post by Christian Schneider:
LinkPortSwigger Web Academy CSWSH lab:

Awesome WebSockets Security / Common WebSocket Weaknesses / Insecure Authentication Mechanism

LinkStratum Security blog post:
LinkHeroku WebSocket Security:

Awesome WebSockets Security / Common WebSocket Weaknesses / Reverse Proxy Bypass using Upgrade Header

Link341about 2 years agoMikhail Egorov's initial PoC from Hacktivity 2019:
Link661over 4 years agoJake Miller's HTTP 2 smuggling tool based on Mikhail's PoC work:
LinkAssetNote blog post with golang h2smuggler tool:

Awesome WebSockets Security / DOM-based WebSocket-URL poisoning

LinkPortswigger summary:

Awesome WebSockets Security / Useful Blog Posts & Resources

LinkPortscanning using WebSockets
LinkWebSocket fuzzing with Kitty fuzzing framework
LinkWebSocket fuzzing harness
LinkProject Zero WebSockets-based buffer overflow
LinkReserved Extension, Subprotocol values

Awesome WebSockets Security / WebSocket Security Tools / Discovery, Fingerprinting, Vulnerability Detection

GitHub337over 4 years agoSTEWS

Awesome WebSockets Security / WebSocket Security Tools / Fuzzing

GitHub144almost 8 years agowebsocket-fuzzer
GitHub18about 7 years agowebsocket-harness

Awesome WebSockets Security / WebSocket Security Tools / Playgrounds

GitHub346almost 2 years agoDVWS: A purposefully vulnerable WebSocket demo
GitHub30almost 5 years agoWebSocket-Playground: Jumpstart multiple WebSockets servers

Awesome WebSockets Security / WebSocket Security Tools / General Utilities & Tools

in-browser toolWebSocket King
in-browser toolHoppscotch.io
GitHub7,234almost 2 years agowebsocat
GitHub416over 8 years agowsd

Awesome WebSockets Security / Bug Bounty Writeups / CSWSH bugs

Slack H1 #207170: CSWSH (plus )
Facebook: CSWSH
Stripo H1 #915541: CSWSH
Coda H1 #535436: CSWSH
Legal Robot #211283: CSWSH
Legal Robot H1 #274324: CSWSH
Grammarly #395729: CSWSH
Undisclosed target: CSWSH
Undisclosed target: CSWSH

Awesome WebSockets Security / Bug Bounty Writeups / Other bugs

PlayStation H1 #873614: Remote code execution over WebSockets
Shopify H1 #409701: SSRF over WebSockets
QIWI H1 #512065: DOM XSS over WebSockets
NodeJS H1 #868834: DoS because no timeout to close unresponsive connections
Bitwala H1 #862835: Broken authentication
Shopify H1 #1023669: Broken authentication
Legal Robot H1 #163464: Information leak
GitHub H1 #854439: Arbitrary SQL queries via injection
Undisclosed target: IDOR over WebSockets
Undisclosed target on BugCrowd: XSS over WebSockets

Backlinks from these awesome lists:

More related projects: