We’re not in HTTP anymore: Investigating WebSocket Server Security
summary
A new open-source stews toolset is released for discovery fingerprinting and vulnerability checks of WebSocket servers: discovery at 5,000+ URLs/s uses a wordlist and zgrab2 fork and hits DNS lookup as the main bottleneck, scanning ~3 million domains and finding 12,819 endpoints (~0.4% of 3M). Fingerprinter runs 50+ fingerprint tests (protocol bits, max frame length, error messages) and often identifies implementations like Gorilla. A vuln detector includes regex DoS checks; demos show local and public scans producing usable fingerprints and exploit detections.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:03What is WebSocket
- 6:05Demo
- 7:37WebSocket Security History
- 13:41WebSocket Tools
- 17:02stews
- 17:36websocket discovery
- 23:54websocket scanning
- 27:06DNS lookups
- 29:22WebSocket endpoint discovery
- 32:20WebSocket fingerprinting
- 33:24Top WebSocket servers
- 34:00Comparing WebSocket fingerprinting tools
- 35:02Identifying features
- 36:25Test categories
- 36:54Test case 200
- 41:31WebSocket vulnerability detection
- 44:05Summary
- 45:17Suggestions
related talks
46mThe Bug Hunter's Methodology 2.0
01h 04mServer-Side Browsing Considered Harmful
46mWeb Security Experts: Are you overlooking WebRTC vulnerabilities?
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
48mKnock knock, who's there Identifying assets in the cloud
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
37mFinding Vulnerabilities in IoT Embedded Devices Using Linux OS and Open Source Tools
26mInternet Scanning - Current State and Lessons Learned