Ihor Bliumental
OWASP Kyiv Chapter Lead
ihor.bliumental@owasp.org
WebSocket security

WebSocket handshake

WebSocket protocol

WebSocket handshake

WebSocket handshake

WebSocket – Javascript API

Authentication

Authorization
• An attacker can access the data/functions
without authorization
• An attacker can access the data/functions
which require higher level of authorization
• An attacker can access other same level user's
restricted data/functions

Cross Origin Resource Sharing

Cross Origin Resource Sharing

Traffic encryption
• All sensitive data should be transferred using
TLS (wss://)
• TLS should be implemented correctly (no weak
ciphers)

Resource Exhaustion
• Connection is being kept until client or server
close it
• An attacker can exhausts all available
connections
• Modern clients have limits (e.g. Chrome: 256
total WS connections, 30 per one host; Firefox:
200 total WS connections)

Improper input validation
• A1 - Injections (SQLi, Code injections, Template
injections, etc.)
• A4 - XXE
• A7 - XSS
• A8 - Insecure deserialisation

Chrome developer tools

Simple WebSocket Client (FF/Chrome addon)

Burp Suite Community Edition

Burp Suite Pro

Burp Suite Pro

OWASP ZAP

OWASP ZAP

Example

Questions?