DB.
Courses

OS Command Injection via WebSockets (Black Box)
OSWE · Chapter 24

OS Command Injection via WebSockets (Black Box)

OS command injection via WebSockets applies the same command-injection principles you know from HTTP to a different transport: many web apps process WebSocket messages with the same unsafe shell-out patterns, and black-box testing them requires intercepting and manipulating the WebSocket frames directly rather than normal HTTP requests.

Key concepts

  • WebSockets are just as capable of carrying injectable input as any HTTP parameter — the vulnerability class (unsanitized input reaching a shell) is identical, only the transport differs.
  • Burp Suite's WebSockets history/interception tools let you intercept, modify, and replay individual WebSocket messages just like HTTP requests.
  • Black-box testing WebSocket-driven features often gets skipped by scanners tuned only for HTTP, making manual review of the WebSocket handshake and message flow especially valuable.
  • Standard OS command injection defenses apply unchanged: avoid shelling out with user input entirely where possible, and if unavoidable, use allow-list validation and pass arguments as an array rather than a concatenated string.

Example

{"action":"ping","host":"127.0.0.1; whoami"}
// If the server naively shells out with the "host" value, this appends a second command

Try it yourself

On a lab app that uses WebSockets for any command-like feature, use Burp Suite to intercept a WebSocket message, and try appending a command separator (`;`, `&&`) to a parameter to see if it is reflected or executed.

ReferenceSearch video walkthroughs

@ Daniel Burlacu