Writeups
-
Medium
Manipulating the WebSocket handshake to exploit vulnerabilities
aggressive but shallow xss filter on a chat socket that bans your ip on a hit, beaten by spoofing X-Forwarded-For in the handshake to shed the ban then slipping an obfuscated oNeRrOr backtick payload
WebSockets 2 min -
Medium
Cross-site WebSocket hijacking
cross-site websocket hijacking where the chat handshake has no csrf token, so an exploit-server page opens an authenticated socket as the victim
WebSockets 3 min -
Easy
Manipulating WebSocket messages to exploit vulnerabilities
manipulating a live chat WebSocket message, editing the intercepted frame after the client html-encodes it so a raw img onerror payload slips through and fires alert() in the support agent’s browser
WebSockets 2 min
Nothing matched that.
No writeups here yet. Try a broader tag, or clear the filter to see everything.
Clear filters