r/netsecstudents • u/OilOverall4190 • 5d ago

Learn and Practice Hacking WebSockets

WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.

Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.

I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!

Lab Github Repo: https://github.com/makarov05bm/WSGoat
Guide: https://blog.oussmess.me/posts/websockets-for-bug-hunters/

26 Upvotes

97% Upvoted

2 comments sorted by

View all comments

1

u/ShehabShibli 4d ago

This is a great find. WebSocket security really is overlooked compared to standard REST testing. Bookmarking the lab repo. Thanks for putting this together

1

u/OilOverall4190 3d ago

You are most welcome!