Neko’s Knowledge Vault
#learning-essential-python-for-pentest-and-reverse #websocket #security #networking #C2 #protocol

WebSocket Protocol Security

WebSockets are a full-duplex, persistent communication channel built on top of TCP, initiated through an HTTP-compatible upgrade handshake. Once established, the connection stays open and both sides can exchange framed messages without reopening TCP connections.

How the Upgrade Works

  1. The client sends a standard HTTP request with headers like:
  2. Upgrade: websocket
  3. Connection: Upgrade
  4. Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== (base64-encoded 16-byte random nonce)

  5. Sec-WebSocket-Version: 13

  6. The server responds with 101 Switching Protocols and a Sec-WebSocket-Accept header calculated from the client's key using a GUID-derived hash.

  7. After the handshake, the connection switches from request/response HTTP to framed WebSocket messages.

Security-Relevant Characteristics

Feature Security Implication
Persistent tunnel WebSockets act like a persistent TCP tunnel through firewalls and proxies that allow HTTP/HTTPS
Full-duplex Data can flow in both directions asynchronously, useful for C2-style communication
Origin header The browser sends Origin, but servers often ignore it
No built-in authentication The protocol itself doesn't authenticate; auth must be handled at application level
Mixed-content policy Browsers block ws:// from HTTPS pages, but wss:// (TLS) is allowed
Frame masking Client-to-server frames are XOR-masked to prevent cache poisoning, not for confidentiality
No same-origin restriction Unlike regular HTTP fetches, WebSocket connections aren't subject to CORS by default

Common Attack Patterns

  • Cross-site WebSocket hijacking (CSWSH) — a malicious site tricks a user's browser into opening a WebSocket to an authenticated target because the server doesn't validate the Origin header or implement CSRF-like tokens.
  • Tunneling through restrictive proxies — because the upgrade looks like HTTP, WebSockets can bypass firewalls and inspection proxies that don't properly dissect the frames.
  • Application-level vulnerabilities — SQL injection, command injection, and deserialization bugs can travel inside WebSocket frames just like in HTTP bodies.
  • Message framing abuse — malformed continuation frames, oversized payloads, or control frame misuse may crash or confuse servers.
  • Downgrade attacks — forcing wss:// to ws:// removes TLS confidentiality and integrity.

Defensive Notes

  • Always use wss:// (TLS) in production.
  • Validate the Origin header and require authentication tokens over the socket.
  • Implement rate limiting and payload-size limits.
  • Treat WebSocket messages as untrusted input at the application layer.
  • Log WebSocket frames for forensics, since many proxies won't.

Python Relevance

For pentest automation, you can interact with WebSockets using websockets or websocket-client libraries, but understanding the upgrade handshake and frame format helps when:
- Building custom clients to probe APIs
- Intercepting or replaying WebSocket traffic from malware
- Fuzzing WebSocket servers with malformed frames
- Detecting WebSocket C2 channels in network traffic

This is a natural extension of raw TCP socket programming because it sits on the same transport layer but adds an application-layer framing protocol. See also TCP Three-Way Handshake and Protocol (Networking).