WebSocketRace

A tool for exploiting race condition type vulnerabilities with websockets.

Some applications have switched from using HTTP as the primary protocol for interacting with data to using the Websockets protocol. However, many race conditions still remain to be found, which is why I created this tool. It can be used to simultanously send 2 websocket requests to an endpoint and detect a Race Condition.

The tool includes a UI but also a standard CLI interface.

Installation

To install run the following:

git clone https://github.com/jakubjn/WebSocketRace.git
pip install -r requirements.txt

Usage (UI)

python3 App.py

Usage (CLI)

To Run:

python3 WebSocketRace.py -gate 'GATE' -r

To Set First Request:

python3 WebSocketRace.py -gate 'GATE' -data_one "REQUEST"

To Set Second Request:

python3 WebSocketRace.py -gate 'GATE' -data_two "REQUEST"

To Set Origin Url:

python3 WebSocketRace.py -gate 'GATE' -o "URL"

To Set Connection Request:

python3 WebSocketRace.py -gate 'GATE' -c "REQUEST"

To Set Cookies:

python3 WebSocketRace.py -gate 'GATE' -b "COOKIES"

To Set Variables:

python3 WebSocketRace.py -gate 'GATE' -v "NAME:VALUE NAME:VALUE"