Lab: Manipulating the WebSocket handshake to exploit vulnerabilities

PRACTITIONER

This online shop has a live chat feature implemented using WebSockets.

It has an aggressive but flawed XSS filter.

To solve the lab, use a WebSocket message to trigger an alert() popup in the support agent's browser.

Hint

If you're struggling to bypass the XSS filter, try out our XSS labs.
Sometimes you can bypass IP-based restrictions using HTTP headers like X-Forwarded-For.

Access the lab

Solution

Click "Live chat" and send a chat message.
In Burp Proxy, go to the WebSockets history tab, and observe that the chat message has been sent via a WebSocket message.
Right-click on the message and select "Send to Repeater".
Edit and resend the message containing a basic XSS payload, such as:
<img src=1 onerror='alert(1)'>
Observe that the attack has been blocked, and that your WebSocket connection has been terminated.
Click "Reconnect", and observe that the connection attempt fails because your IP address has been banned.
Add the following header to the handshake request to spoof your IP address:
X-Forwarded-For: 1.1.1.1
Click "Connect" to successfully reconnect the WebSocket.
Send a WebSocket message containing an obfuscated XSS payload, such as:
<img src=1 oNeRrOr=alert`1`>

Community solutions

Michael Sommer (no audio)

Want to track your progress and have a more personalized learning experience? (It's free!)

Sign up Login

In this topic

WebSockets testing What are WebSockets? Cross-site WebSocket hijacking

Register for free to track your learning progress

The benefits of working through PortSwigger's Web Security Academy

Practise exploiting vulnerabilities on realistic targets.
Record your progression from Apprentice to Expert.
See where you rank in our Hall of Fame.

Already got an account? Login here