EncryptCodecencryptcodec
Simulations/WebSocket Hijacking

WebSocket Hijacking

Intermediate

This WebSocket server accepts connections without validating the origin. Craft a cross-origin connection to intercept private messages, then apply fixes to secure it.

Progress:
1
Intercept Messages
2
Secure the Connection
attacker-page.html

Cross-Origin WebSocket Client

ws://app.corp.io:8080/feed
Server-Side Controls
WebSocket Handshake Log
Click Connect to initiate WebSocket handshake...

Challenges

1
Intercept Messages
Connect to the WebSocket from a cross-origin page and read private messages.
▼ hints
2
Secure the Connection
Apply the fix: validate Origin and require an auth token in the first message.
▼ hints
How to fix WebSocket hijacking
Origin validation and token-based authentication
▼

Frequently Asked Questions