Websocket Security
This one gives Claude the protocol fundamentals, CSWSH exploitation flows, and tooling bridges for WebSocket penetration testing. You get handshake inspection patterns, an actual proof-of-concept JavaScript snippet for cross-site hijacking, and practical commands for wsrepl, ws-harness, and Burp extensions like SocketSleuth. The decision tree walks through Origin validation, session binding checks, and message fuzzing. It also covers WebSocket smuggling concepts for proxy bypass scenarios. Load it when you're dealing with real-time features, chat apps, live dashboards, or notification streams where the upgrade handshake and bidirectional channel create attack surface that traditional HTTP testing misses.
- install copies · 90 days. Times the install command was copied on this site in the last 90 days, bots filtered.
- 5
- skills.sh installs
- 4K
- GitHub stars
- 2.6K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yaklang/hack-skills --skill websocket-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
SKILL: WebSocket Security
AI LOAD INSTRUCTION: This skill covers WebSocket protocol basics, cross-site WebSocket hijacking (CSWSH), practical tooling bridges, and common vulnerability classes. Apply only in authorized tests; treat tokens and message content as sensitive. For REST/GraphQL companion testing, cross-load api-sec when present in the workspace.
0. QUICK START
During proxy or raw traffic review, watch for:
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
Sec-WebSocket-Protocol: optional-subprotocol
Server success response indicators:
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=
Routing note: in Burp/browser DevTools, filter for 101 and Upgrade: websocket; for deeper API testing, align authn/authz models through api-sec.
1. PROTOCOL BASICS
Client request (typical)
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yaklang/hack-skills
- Categories
- Backend & APIs, Security
- First seen
- May 16, 2026
More from yaklang/hack-skills
All 102- Api Authorization And Bola3.9K
- Auth Sec3.9K
- Kubernetes Pentesting3.9K
- Cors Cross Origin Misconfiguration3.9K
- Ios Pentesting Tricks3.9K
- Injection Checking3.9K
- Recon For Sec3.9K
- Llm Prompt Injection3.9K
- Heap Exploitation3.9K
- Csrf Cross Site Request Forgery3.9K
- Business Logic Vuln3.9K
- Traffic Analysis Pcap3.9K
- Oauth Oidc Misconfiguration3.9K
- Anti Debugging Techniques3.9K
- Binary Protection Bypass3.9K
- Cmdi Command Injection3.9K
- Path Traversal Lfi3.9K
- Ssti Server Side Template Injection3.8K
- Graphql And Hidden Parameters3.8K
- Kernel Exploitation3.8K
- Race Condition3.8K
- Xxe Xml External Entity3.8K
- Deserialization Insecure3.8K
- Request Smuggling3.8K
Recommended
More Backend & APIs
api-authorization-and-bolayaklang/hack-skillsAPI authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authoriza3.9Kskills.sh installsssti-server-side-template-injectionyaklang/hack-skillsSSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.3.8Kskills.sh installs
aws-sdk-java-v2-lambdagiuseppe-trisciuoglio/developer-kitProvides AWS Lambda patterns using AWS SDK for Java 2.x. Use when invoking Lambda functions, creating/updating functions, managing function configurations, work3.8Kskills.sh installs
redis-developmentredis/agent-skillsRedis performance optimization and best practices. Use this skill when working with Redis data structures, Redis Query Engine (RQE), vector search with RedisVL,3.1Kskills.sh installs