Lab: Manipulating Web Socket messages to exploit vulnerabilities

Summary: PortSwigger's WebSockets lab presents an online shop whose live chat runs over WebSockets, with messages viewed by a support agent in real time. The client HTML-encodes a typed '<' character before sending, but intercepting the WebSocket message in Burp Proxy and replacing it with the payload <img src=1 onerror='alert(1)'> triggers an alert in the browser, and the lab states this also happens in the support agent's browser.
What's compelling: The client-side encoding gave no protection once the message was edited in transit, so a support agent opening a chat message can be the one who executes the attacker's payload.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026