exploiting-websocket-vulnerabilities
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides functional payloads designed to test for command injection vulnerabilities, specifically demonstrating the use of shell metacharacters (e.g.,
; whoami) within WebSocket messages. - [COMMAND_EXECUTION]: Utilizes multiple shell-based Python HEREDOC patterns (
python3 << 'PYEOF') to execute dynamic testing scripts for automation of injection and authorization bypass attacks. - [DATA_EXFILTRATION]: Includes a Cross-Site WebSocket Hijacking (CSWSH) proof-of-concept script that demonstrates the exfiltration of sensitive data intercepted from a WebSocket connection to a remote attacker-controlled URL (
https://attacker.example.com/collect). - [EXTERNAL_DOWNLOADS]: Recommends the installation of external security tools and libraries from public registries, including
websocat(via Cargo),wscat(via NPM), and thewebsocketslibrary (via Pip). - [DATA_EXFILTRATION]: Contains instructions for testing path traversal vulnerabilities using sensitive system file paths such as
../../../etc/passwdto verify insecure file access over WebSockets.
Audit Metadata