wsprobe: testing WebSockets after the upgrade

wsprobe is a WebSocket security review toolkit: a Python CLI with a Burp Suite extension. It owns the handshake, speaks the app's message language, and tests what happens after the upgrade: the handshake itself, authorization across two identities, frame fields, and replay.

What HTTP tools miss after the upgrade

A WebSocket starts as an ordinary HTTP GET. At 101 Switching Protocols it stops being HTTP and becomes a raw two-way socket that stays open for the life of the app. The checkpoint HTTP walks on every request is walked once here, at the upgrade, so the defects that matter live after it:

  • a frame that acts as another user, because the server never re-derived who sent it;
  • a control frame accepted with no per-message check;
  • a state-changing frame that can be replayed, because it carries no nonce.

HTTP tooling is built around one-shot requests, and a live socket needs a client that owns the handshake, speaks the app's message language, holds connection state and drives its own sockets. wsprobe is that client.

The target profile

Everything target-specific lives in one profile: the handshake, how a token is acquired and kept fresh, and the message vocabulary. It can be written by hand or drafted from a capture, and every check reads it. The refresh setting matters on real apps, many of which mint a single-use token per connection.

One profile carries everything target-specific. Every check reads it.

Release

Open source at github.com/munishkharb/wsprobe, where the README walks through every command. It is for systems you are authorized to test. The WebSocket security post covers the bug classes it is built around.