Web Socket Turbo Intruder: Unearthing the Web Socket Goldmine
Summary: PortSwigger researcher @zakfedotkin published WebSocket Turbo Intruder, a Burp Suite extension that brings Turbo Intruder's fast attack engine to WebSocket testing, installable from the BApp Store or built from GitHub. The tool adds a THREADED engine for parallel connections to test race conditions, HTTP Middleware that wraps a WebSocket in an HTTP request so automated scanners can test it, and a WS Logger that records up to 1,000 messages.
What's compelling: The post notes that many testers and tools give up once a protocol upgrade to WebSocket occurs, leaving broken access controls, race conditions, and SQL injection undetected. The author also found a denial-of-service flaw in a Java WebSocket implementation that allocates a buffer from the header's payload length field and crashes with Out Of Memory at Integer Max Value.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026