websocket-security — Skills

What it does

Upgrade: websocket and Connection: Upgrade — required upgrade handshake.

Sec-WebSocket-Key — base64 nonce; server hashes with magic GUID and responds with Sec-WebSocket-Accept.

Sec-WebSocket-Version: 13 — current standard version for browser interoperability.

HTTP/1.1 101 Switching Protocols — handshake complete; subsequent frames are WebSocket binary/text frames per RFC.

The server does not validate Origin (or equivalent binding) on the WebSocket handshake, and

The victim has an active session (cookie-based or browser-stored creds) to the target site.

SocketSleuth — inspect and manipulate WebSocket traffic inside Burp.

Requirements & configuration

Use a plugin to reproduce browser cookies, headers, or token refresh during the WebSocket lifecycle.

| Auth token in URL (wss://host/ws?token=...) | Logs, proxies, Referer leakage, browser history |

Prefer Sec-WebSocket-Protocol, first-message auth, or cookie + CSRF token patterns aligned with product constraints.

2. Handshake review — Are Origin, Host, and Cookie policies correct? Any token in query string?

| HAProxy | Depends on option http-server-close vs tunnel mode |

Configuration: HTTP

websocket security

Source

Repository: https://github.com/yaklang/hack-skills

websocket-security FAQ

What does the websocket-security skill do?

>- WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs. Upgrade: websocket and Connection: Upgrade — required upgrade handshake. Sec-WebSocket-Key — base64 nonce; server hashes with magic GUID and responds with Sec-WebSocket-Accept.

What does websocket-security require?

Use a plugin to reproduce browser cookies, headers, or token refresh during the WebSocket lifecycle. | Auth token in URL (wss://host/ws?token=...) | Logs, proxies, Referer leakage, browser history | Prefer Sec-WebSocket-Protocol, first-message auth, or cookie + CSRF token patterns aligned with product constraints. 2. Handshake review — Are Origin, Host, and Cookie policies correct? Any token in query string? | HAProxy | Depends on option http-server-close vs tunnel mode | Configuration keys: HTTP.

How do I install websocket-security?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill websocket-security --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain websocket-security?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[websocket-security on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-websocket-security?ref=badge)

npx agentictools info skills/yaklang-hack-skills-websocket-security

The second line is the CLI lookup for this page — handy in READMEs and docs.