Category Archives: websocket

How to Remediate a Cross-Site WebSocket Vulnerability

Posted on by

Today, many leading industries and modern enterprises have switched from processing and acting on data stored in databases to data in flight. How? Through real-time applications. One way to enable this is WebSocket, but it comes with vulnerabilities as well.  What Is WebSocket? Real-time applications operate within an immediate time frame; sensing, analyzing and acting […]

The post How to Remediate a Cross-Site WebSocket Vulnerability appeared first on Security Intelligence.

Continue reading How to Remediate a Cross-Site WebSocket Vulnerability→

How do I stop external sites from doing ws://localhost and doing funny things to non-HTTP servers? [duplicate]

Posted on by

Discovered a certain site that I would rather not link was being mean and probing a bunch of ports with ws://127.0.0.1:port and wss://127.0.0.1:port. I want to put a stop to it, but how? Then discovered ebay was doing the same thing and on… Continue reading How do I stop external sites from doing ws://localhost and doing funny things to non-HTTP servers? [duplicate]→

How to view all SSL certificates for a website using Google Chrome?

Posted on by

How to view all SSL certificates for a website using Chrome? When I click the lock icon, it shows only one certificate. The Security tab shows the same – details of only one certificate. How can I see all the certificates on a website? Is … Continue reading How to view all SSL certificates for a website using Google Chrome?→

Is SSL over WebSocket less necessary when a connection is established from a smartphone?

Posted on by

I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically playing on the server.
In order for a client… Continue reading Is SSL over WebSocket less necessary when a connection is established from a smartphone?→

Intercept and modify Server-Sent Events (EventSource API)

Posted on by

I’m working with a web application using Server-Sent Events (SSE, EventSource API), similar to WebSockets. However, none of the commonly penetration test tools seem to fully support this.
I’ve tried Burp Professional, OWASP ZAP and mitmpro… Continue reading Intercept and modify Server-Sent Events (EventSource API)→