Pasindu's Blog

Manipulating WebSocket messages to exploit vulnerabilities

2 min read

PortSwigger

Lab Description

This online shop has a live chat feature implemented using WebSockets.
Chat messages that you submit are viewed by a support agent in real time.
Objective: Use a WebSocket message to trigger an alert() popup in the support agent’s browser.

Step 1: Understanding the Vulnerability

WebSocket communication is bidirectional and persistent. Unlike HTTP requests, WebSocket messages are not automatically sanitized by the browser in the same way. If the server or client fails to properly encode user input before rendering it in another user’s browser (e.g., a support agent viewing chat messages), an attacker can inject malicious JavaScript.

In this lab:

  • Users send chat messages via WebSockets
  • A support agent views these messages in real time
  • The client-side encodes some characters (like <), but with interception we can bypass this

Step 2: Reconnaissance

  1. Click Live chat on the lab website.
  2. Send a test message (e.g., Hello).
  3. In Burp Suite, go to the Proxy → WebSockets history tab.
  4. Observe that chat messages are transmitted as WebSocket messages, not HTTP requests.

Step 3: Testing for Encoding

  1. Send a new message containing a < character (e.g., <test).

  2. In Burp’s WebSockets history, inspect the corresponding message.

  3. Notice that the < has been HTML-encoded by the client before sending (e.g., becomes &lt;).

This indicates the client is trying to prevent XSS, but the protection is client-side only and can be bypassed.

Step 4: Intercepting and Modifying WebSocket Messages

  1. In Burp Proxy, enable Intercept WebSocket messages (in Proxy → Proxy Settings → WebSocket Interception Rules Messages).

  2. Send another chat message (e.g., x).

  3. In the intercepted WebSocket message, replace the message content with the following payload:

<img src=1 onerror='alert(1)'>

  1. Send the message.

Step 5: Triggering the Alert

  • After forwarding, the browser executes the payload.
  • An alert(1) popup appears in your browser.
  • Because the support agent views the same chat feed in real time, the popup also appears in their browser — solving the lab.

Step 6: Lab Solved

Success message displayed:

Key Takeaway

Never trust client-side encoding.
WebSocket messages must be sanitized and validated on the server-side before being sent to other users. Client-side protections can be trivially bypassed with interception tools like Burp Suite.

Graph View