WebSocket Security Testing for Bug Bounty Hunters

WebSocket Security Testing for Bug Bounty Hunters

WebSockets feel exotic until you realize they are long-lived request/response channels with a weird upgrade handshake. Same bugs apply: broken auth, IDOR on message payloads, XSS via reflected events, and cross-site hijacks when cookies ride the handshake.

OWASP’s WebSocket testing guide is a solid checklist. Here is how I run it on real targets.

Start at the handshake

Capture the GET Upgrade request in Burp or your proxy:

• Does it require a session cookie, Authorization header, or a short-lived ticket query param?
• Can you replay the ticket from another account?
• Is Origin checked? Missing origin validation opens cross-site WebSocket hijacking (CSWSH) when cookies are included automatically.

If the socket accepts connections with only a guessable roomId and no auth, you already have a finding — map what messages reveal next.

Message-layer hunts

Once connected, treat every JSON frame like an API body:

• Swap resource IDs (chatId, orderId, userId)
• Subscribe to another tenant’s channel names
• Send admin-only event types the UI never emits
• Inject HTML/JS into fields that other clients render in a desktop webview

Race conditions show up here too — duplicate “claim reward” frames, double spend on wallet events — because clients retry aggressively.

CSWSH vs “just open WS”

CSWSH needs a browser to attach the victim’s cookies to a cross-site socket. Prove it with a minimal HTML page on your attacker origin that opens wss://target and reads a sensitive first message. If the app uses bearer tokens in JS only, classic CSWSH weakens; token theft or XSS becomes the prerequisite.

PortSwigger’s cross-site WebSocket hijacking material pairs well with this test plan.

Reporting tips

Include:

1. Handshake request/response
2. One illicit message and the data returned
3. Whether exploitation needs CSRF/CSWSH or just a stolen URL
4. Impact (read chats, mutate orders, push malware links to operators)

Skip “WebSocket without WSS” unless the program cares about network attackers on LAN — many do not pay for that alone on public internet apps.

I hunt sockets the same week I hunt REST. The transport changed; the authorization bugs did not.