Manipulating the WebSocket handshake to exploit vulnerabilities

PortSwigger

Lab Description

This online shop has a live chat feature implemented using WebSockets.
It has an aggressive but flawed XSS filter.
Objective: Use a WebSocket message to trigger an alert() popup in the support agent’s browser.

---

Step 1: Understanding the Vulnerability

This lab presents two layers of protection that must be bypassed

The XSS filter is aggressive but flawed. After detecting an attack, it bans your IP address, but the ban can be bypassed by spoofing the X-Forwarded-For header during the WebSocket handshake.

Step 2: Reconnaissance

1. Click Live chat and send a test message (e.g., Hello).

2. In Burp Proxy → WebSockets history, observe the chat message WebSocket.

3. Right-click the message → Send to Repeater

Step 3: Testing Basic XSS Payload

1. In Repeater, edit the WebSocket message to:

<img src=1 onerror='alert(1)'>

2. Send the message.

Observed behavior:

• The attack is blocked
• Your WebSocket connection is terminated
• Subsequent connection attempts fail (IP banned)

Step 4: Bypassing the IP Ban

Step 4.1: Locate the Handshake Request

1. In Burp, go to Proxy → HTTP history
2. Find the WebSocket handshake request (look for 101 Switching Protocol response)
3. Right-click → Send to Repeater

Step 4.2: Spoof IP Address

In Repeater, add the following header to the handshake request:

X-Forwarded-For: 1.1.1.1

Step 4.3: Reconnect

1. Click Connect in the WebSocket tab of Repeater
2. The connection should succeed with the spoofed IP

Why this works: The server uses X-Forwarded-For to determine the client’s IP address for rate limiting/banning. By spoofing this header, you bypass the ban.

Step 5: Bypassing the XSS Filter

The XSS filter blocks basic payloads. Try an obfuscated payload:

<img src=1 oNeRrOr=alert`1`>

Breakdown of obfuscation:

• oNeRrOr → Mixed case bypasses case-sensitive filters
• alert`1` → Using backticks instead of parentheses bypasses filters looking for alert()

Step 6: Delivering the Final Attack

1. In Repeater, ensure you have:
   • Spoofed X-Forwarded-For header in the handshake
   • An active WebSocket connection
2. Send the obfuscated payload in a WebSocket message:

<img src=1 oNeRrOr=alert`1`>

3. The payload triggers an alert(1) popup in:
   • Your browser (for testing)
   • The support agent’s browser (solving the lab)

Step 7: Lab Solved

Success message displayed:

---