Manipulating WebSocket messages to exploit vulnerabilities

Platform: PortSwigger | Category: WebSockets | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, WebSockets

Summary

Walkthrough of the PortSwigger Web Security Academy lab Manipulating WebSocket messages to exploit vulnerabilities (WebSockets). This lab demonstrates a websockets vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — WebSockets

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

The majority of input-based vulnerabilities affecting WebSockets can be found and exploited by tampering with the contents of WebSocket messages.

For example, suppose a chat application uses WebSockets to send chat messages between the browser and the server. When a user types a chat message, a WebSocket message like the following is sent to the server:

 json read-only • copy allowed Copy
{"message":"Hello Carlos"}

The contents of the message are transmitted (again via WebSockets) to another chat user, and rendered in the user's browser as follows:

 html read-only • copy allowed Copy
<td>Hello Carlos</td>

In this situation, provided no other input processing or defenses are in play, an attacker can perform a proof-of-concept XSS attack by submitting the following WebSocket message:

 json read-only • copy allowed Copy
{"message":"<img src=1 onerror='alert(1)'>"}

Solution :

The lab's home page has a link to Live chat.

There we have an option to chat or send message to another user.

We can view all the websocket requests & responses that have been sent and received under the Web Sockets history tab in Burp.

Since there is no sanitization of user input, we can send the following xss payload by intercepting the request & changing the value of message field in the JSON data.

 js read-only • copy allowed Copy
<img src=1 onerror='alert(1)'>

Now both the client & the server users will get an XSS alert poopup.

And now we have solved the lab.

Key Takeaways / Lessons

• Understanding WebSockets detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Manipulating WebSocket messages to exploit vulnerabilities