WebSocket messages to exploit vulnerabilities

🎯 Objective

Intercept and analyze WebSocket messages exchanged by the live chat to observe sensitive data in transit.

🧭 Scope / Setup

• Tooling: Burp Suite (Proxy, WebSockets history tab, Intercept)
• Feature: Live Chat over WebSockets

🔎 Workflow

1. With the proxy running, open the chat and generate traffic.
2. In Proxy → WebSockets history, locate the relevant WS connection.
3. Intercept a client message and replay/modify as needed.
4. Review server responses for sensitive data or logic flaws.

Screenshots

• WebSockets history view:
  
• Intercepted message:
  
• Cleartext alert shown in browser:
  

✅ Outcome

• Verified that messages (including alerts) could be observed/manipulated via WS.
• Identified potential exposure of sensitive content over WS channel.

🛡️ Mitigations

• Enforce authentication and per‑message authorization on the server side.
• Validate and sanitize all inbound WS messages.
• Consider message signing or server-side filtering to prevent UI injection.

📝 Notes

• WebSockets bypass many classic HTTP middleware—treat them as a first‑class attack surface.