From appsec
This skill should be used when the user asks to "check WebSocket security", "analyze WebSocket authentication", "find WebSocket vulnerabilities", "audit WebSocket handlers", "check for CSWSH", or mentions "WebSocket", "ws://", "wss://", "socket.io", "CSWSH", "WebSocket origin check", "WebSocket rate limit", or "WebSocket authentication" in a security context.
npx claudepluginhub florianbuetow/claude-code --plugin appsecThis skill uses the workspace's default tool permissions.
Analyze WebSocket implementations for security vulnerabilities including
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Analyze WebSocket implementations for security vulnerabilities including missing authentication on the upgrade handshake, no origin validation (Cross-Site WebSocket Hijacking), absence of message validation, missing rate limiting on messages, and use of unencrypted ws:// in production. WebSocket connections are long-lived and bidirectional, making them a persistent attack channel when not properly secured.
Read ../../shared/schemas/flags.md for the full flag specification. This skill
supports all cross-cutting flags. Key flags for this skill:
--scope determines which files to analyze (default: changed)--depth standard reads code and checks WebSocket handlers and configuration--depth deep traces message handling from connection through all event handlers--severity filters output (WebSocket issues are often high or critical)Key CWEs in scope:
Read references/detection-patterns.md for the full catalog of code patterns,
search heuristics, language-specific examples, and false positive guidance.
Parse flags and resolve the file list per ../../shared/schemas/flags.md.
Filter to files likely to contain WebSocket logic:
**/ws/**, **/websocket/**, **/socket/**)**/io.*, **/socket.*)**/handlers/**, **/events/**)**/middleware/**)**/client/**, **/frontend/**)Detect scanners per ../../shared/schemas/scanners.md:
semgrep -- primary scanner for WebSocket patternsRecord which scanners are available and which are missing. WebSocket-specific scanners are rare; most analysis relies on code review.
If semgrep is available, run with rules targeting WebSocket:
semgrep scan --config auto --json --quiet <target>
Filter results to rules matching WebSocket patterns. Normalize output to the findings schema.
Regardless of scanner availability, perform manual code analysis:
Origin header
during the WebSocket handshake to prevent CSWSH.wss:// not
ws:// for encrypted transport.When --depth deep, additionally trace:
Format output per ../../shared/schemas/findings.md using the WS prefix
(e.g., WS-001, WS-002).
Include for each finding:
These are the high-signal patterns specific to WebSocket security. Each maps
to a detection pattern in references/detection-patterns.md.
Missing authentication on upgrade -- WebSocket server accepts connections without verifying the client's identity during the HTTP upgrade handshake.
No origin validation (CSWSH) -- The server does not check the Origin
header, allowing malicious websites to open WebSocket connections to the
server using the victim's cookies.
No message validation -- Incoming WebSocket messages are parsed and processed without schema validation, enabling injection attacks.
No rate limiting -- No limit on message frequency, allowing a single client to flood the server with messages.
Unencrypted transport (ws://) -- Production WebSocket connections use
ws:// instead of wss://, exposing data in transit.
| Scanner | Coverage | Command |
|---|---|---|
| semgrep | WebSocket auth patterns, origin checks | semgrep scan --config auto --json --quiet <target> |
Fallback (no scanner): Use Grep with patterns from references/detection-patterns.md
to find WebSocket server configuration, connection handlers, message handlers,
and origin checking logic. Report findings with confidence: medium.
Use the findings schema from ../../shared/schemas/findings.md.
WS (e.g., WS-001)websocketspecializedWSCWE-287, CWE-346, CWE-20A07:2021 (Identification and Authentication Failures)S (Spoofing) or T (Tampering)Severity guidance for this category: