CSWSH Proof of Concept

Cross-Site WebSocket Hijacking — generic PoC, no hardcoded credentials required

LEGAL DISCLAIMER: This PoC is for authorized security testing and bug bounty programs only. Unauthorized access to computer systems is illegal. Do not use against targets without explicit written permission. This page demonstrates a generic CSWSH vulnerability pattern — it does NOT exploit any specific user account.
Configuration PARAMS
Vulnerability Checklist STATUS
CheckResult
CORS allows any Originpending
WebSocket cross-origin acceptedpending
Engine.IO SID grantedpending
Socket.IO namespace connectedpending
Cookies exist for target domainpending
Cookies sent in WS handshakepending
Session auto-authenticatedpending
Real-time data leakedpending
How to Verify Cookies in WebSocket Handshake GUIDE

Method 1: Browser DevTools (direct proof — see actual Cookie header)

  1. Open DevTools (F12)
  2. Go to Network tab
  3. Click Run Full PoC button below
  4. In Network tab, filter by WS (WebSocket)
  5. Click on the WebSocket connection to node1-app.litemarkets.com
  6. Look at Headers section, find Request Headers → Cookie:
  7. If you see cookies like _identity-frontend=...; _protected=... — cookies ARE being sent to a cross-origin page

Method 2: Behavioral proof (automated — what this PoC checks)

  1. Make sure you are logged into my.liteforex.eu in this browser
  2. Click Cookie Probe — it fetches a protected page to verify cookies exist
  3. Click Run Full PoC — opens WebSocket from this page's origin
  4. If server sends ready event with user data → cookies authenticated the session → CSWSH confirmed
  5. If no personal data → either no cookies exist (not logged in) or SameSite blocks cross-site cookies

Method 3: no-corp fetch (iframe trick — see cookies without reading them)

The PoC uses a hidden iframe + fetch to detect if the browser sends cookies to the target, and an opaque response tells us cookies exist (response size differs for logged-in vs not-logged-in users).

Live Log Disconnected
Raw Frames Captured 0 frames
No frames captured yet. Run the PoC to start.