WebSocket Turbo Intruder Unearthing the WebSocket Goldmine

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/websocket-turbo-intruder-unearthing-the-websocket-goldmine
• Blog Title: WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine
• Suggested Section: Generic Hacking > Web Application Hacking > WebSockets & Socket.IO (Fuzzing, Races, DoS) with Turbo Intruder

🎯 Content Summary

What the post delivers
A hands-on guide to WebSocket Turbo Intruder (a Burp Suite extension) that brings Turbo Intruder–style Python scripting and high‑rate fuzzing to WebSockets, plus concrete exploitation workflows (Socket.IO handling, server-side prototype pollution detection, race‑condition testing), a denial‑of‑service PoC, an HTTP middleware to auto‑scan WS apps, a CLI, and a WS logger.

Install and scope
• Install from the <a href="https://portswigger.net/bap...

🔧 Technical Details

Bridge WS behind HTTP to auto-scan: Wrap a persistent WS connection with a local HTTP endpoint and forward request bodies as WS messages. Use regex decorators (e.g., @MatchRegex) to filter noise so generic HTTP scanners can reliably probe server-side sinks (SQLi, auth bypass, command injection).

Socket.IO handshake + heartbeat scripting: Detect EIO=4, send the opening "40" packet, then emit events (e.g., 42["message","hello"]) while automating heartbeats via @PingPong("2","3")/@Pong("3"). This keeps sessions stable for high‑rate fuzzing.

Prototype-pollution detection via WS payloads: Send {"__proto__":{"initialPacket":"Polluted"}} through Socket.IO. If the greeting or behavior changes, you’ve polluted server-side prototypes (often Express internals). Generalize by probing for server behaviors that read prototype-inherited properties.

Concurrent WS race...

🤖 Agent Actions

I analyzed the PortSwigger research post and explored the HackTricks repository to find the best places to integrate the techniques. The existing “WebSocket Attacks” page was the right place to add Turbo Intruder for WebSockets, Socket.IO protocol handling, server-side prototype pollution detection via WS payloads, the WS “Ping of Death” DoS PoC, CLI usage, and the HTTP middleware/adapter technique. I also expanded the “Race Condition” page to cover WebSocket races using Turbo Intruder’s THREADED engine.

What I changed:

• Updated src/pentesting-web/websocket-attacks.md:

  • Added a comprehensive section on WebSocket Turbo Intruder covering:
    • Installation/usage and engines
    • Basic fuzzing script and Message filtering with @MatchRegex
    • HTTP Middleware (bridge WS behind HTTP for scanner automation)
    • Socket.IO handshake/heartbeat scripting with Ping/Pong decorators and event emission
    • Server-side prototype pollution detection via Socket.IO with {"proto":{...}} payload
    • WS race testing using THREADED engine (and link to race-condition page)
    • WebSocket “Ping of Death” DoS via malformed frames (OOM)
    • CLI usage for headless fuzzing
    • Debugging tips (WS Logger, inc/dec helpers, isInteresting, decorators)
    • Operational safety notes
  • Kept all existing content and added the new material in the Websocket Fuzzing area.
  • Updated the References section with:
    • Blog URL
    • BApp Store entry
    • GitHub repository
    • Turbo Intruder background
    • Server-side prototype pollution methodology
    • WS race PoC repo and example scripts

• Updated src/pentesting-web/race-condition.md:

  • Expanded the “RC in WebSockets” section to include WebSocket Turbo Intruder’s THREADED engine for concurrent WS connections (with link to example script).
  • Appended new references:
    • Blog URL
    • WebSocketTurboIntruder GitHub
    • RaceConditionExample.py

No new files were created; all changes were made to the most relevant existing pages.

Notes:

• The additions are highly technical and include code blocks consistent with HackTricks style.
• I preserved existing content and enhanced it with new, relevant info.
• Internal links to race-condition.md and NodeJS prototype pollution content are included.
• References are consolidated at the end of the modified pages as required.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/websocket-turbo-intruder-unearthing-the-websocket-goldmine

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking > Web Application Hacking > WebSockets & Socket.IO (Fuzzing, Races, DoS) with Turbo Intruder".

Repository Maintenance:

• MD Files Formatting: 876 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge