WebSocket Security

Offensive testing of WebSocket and Socket.IO endpoints. Apply only on authorized targets; treat tokens and message content as sensitive. WebSocket auth/authz usually mirrors the same backend's REST models — align your session and resource-boundary assumptions with how the HTTP API behaves. (To build secure real-time systems rather than attack them, see the sibling websocket-patterns skill.)

Quick Start — Spot the Channel

In a proxy or raw traffic review, filter for 101 and Upgrade: websocket:

GET /ws HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13

HTTP/1.1 101 Switching Protocols
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=