Day-4: Okay so I was scrolling on Twitter and read this, This made me think what the heck is WebSocket? I never heard about it before!👀

Also, he got $8000 as Bug bounty for his submission on another report! Basically, it was somewhat related to Npm token as well as WebSocket hijacking! At first, I watched his WriteUp Video and then read his WriteUp but was not clear so I thought let's understand the concept and then maybe I understand what he wanted to say!

What is WebSocket?

• Ohhhh lol, Websocket is just like Http, a communication protocol that enables interaction between a browser and a web server. I thought it was linked with a socket or something (Just Kidding)!

• WebSocket is especially great for services that require continuous data exchange, e.g. online games, real-time trading systems and so on. For example, Slack’s web app uses WebSocket connections to sync messages in its chat functionality.

• During the lifetime of a WebSocket connection, the client and the server are free to exchange any amount of data without incurring the overhead and latency of using traditional HTTP requests.

• For more good Understanding I prefer you to watch this https://www.youtube.com/watch?v=ZbrEztkwcw8!

How WebSocket it different from HTTP?

• https://www.youtube.com/watch?v=i5OVcTdt_OU

How WebSocket connections are created?

• A WebSocket connection between a client and a server is established through a WebSocket handshake.
• To open a WebSocket connection, we need to create new WebSocket using the special protocol ws:// in the URL.
• There's also an encrypted wss:// protocol. It’s like HTTPS for WebSockets.

Problems with WebSocket?

• WebSocket allows an unlimited number of connections to the target server and thus resources on the server can be exhausted because of DOS attack.
• WebSockets are vulnerable to malicious input data attacks, therefore leading to attacks like Cross-Site Scripting (XSS).
• The Websocket protocol doesn’t handle authorization and/or authentication. Application-level protocols should handle that separately in case sensitive data is being transferred.
• Also, some more problems, Do refer WebSocket Issues for the same!

PS: Now I got Idea what actually WebSocket is, So probably I'll do research about Hijacking WebSockets on Day-5! I hope my notes from different websites are/will helping/help you! Thanks!❤️

Resources

Aseem's WriteUp: https://medium.com/@aseem.shrey/one-token-to-leak-them-all-the-story-of-a-8000-npm-token-79b13af182a3
Aseem's WriteUp Video: YouTube
Javascript Docs: https://javascript.info/websocket
Infosecinstitue: WebSocket Issues

Contact:

Got doubts? Contact me on Twitter.
Feedbacks are welcomed, do comment it down below! :)