WSGoat

KO | EN

gitlite — search

#github #php #anthropic #css #devops #markdown #web #svg #reactjs #git

(★ 9)

The vulnerable application that will teach you how to hack WebSockets

File Explorer

ZIP Download

- init.sql
- index.html
- index.html
- server.js
docker-compose.yml
Dockerfile
package.json
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

A deliberately vulnerable, Dockerized WebSocket application designed for learning and practicing WebSocket security testing in a controlled environment.

The lab implements a realistic web application with authentication, private messaging, user profiles, and multiple WebSocket endpoints. Each feature provides an opportunity to study how WebSocket-specific vulnerabilities arise when authentication, authorization, and application-level security controls are incorrectly implemented.

## Start

```bash
docker compose up --build
```

Open:

http://localhost:3000

## Test

Create two accounts in two browser profiles/incognito windows.

Example:

User A:
- register `alice`
- password `password123`

User B:
- register `bob`
- password `password123`

Each account receives an 8-character user code.

Enter Bob's code from Alice's session. Enter Alice's code from Bob's session.
The two clients will join the same conversation.

## Guide
I wrote a [walkthough](https://blog.oussmess.me/posts/websockets-for-bug-hunters/) of the bugs present in the lab, and it will be updated regularily.

I also encourage you to watch this [talk](https://www.youtube.com/watch?v=bMFP71UAbPo) from OWASP

and this [video](https://www.youtube.com/watch?v=97gPr9FdXzE) from BBRE

## References
https://websocket.org/guides/authentication/

https://christian-schneider.net/blog/cross-site-websocket-hijacking/

WSGoat

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

WSGoat

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README