Manipulating Web Socket messages with Burp Suite - Port Swigger
Summary: PortSwigger's tutorial explains that finding vulnerabilities in WebSockets generally involves manipulating messages in ways the application doesn't expect, such as modifying existing messages or creating new ones to deliver SQL injection or cross-site scripting exploits. It walks through how to modify and resend WebSocket messages in Burp Suite's Repeater, using the company's Manipulating WebSocket messages to exploit vulnerabilities Web Security Academy lab as a follow-along exercise.
What's compelling: WebSocket traffic carries the same injection risk as any other input path, and the technique here is simply editing a message and resending it - a low bar for anyone probing your application's real-time channels.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026