Other nomination

Unveiling vulnerabilities in WebSocket APIs

Mikhail Egorov · Speaker Deck · 25 October 2019

The slides survey WebSocket API weaknesses, including cross-site hijacking through weak Origin checks and missing authentication or object-level authorization on messages. They also show how incomplete reverse-proxy upgrade validation can turn a WebSocket tunnel into arbitrary HTTP access to internal endpoints.

Record

Researcher

Mikhail Egorov

Published by

Speaker Deck

Date

25 October 2019

Format

Slides

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• websocket
• csrf
• origin-validation
• idor
• auth-bypass
• request-smuggling
• reverse-proxy
• same-origin-policy
• http
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Mikhail Egorov, first published at the original source. Preserved copies are kept so the citation survives its host.