Kali Linux Web Penetration Testing Cookbook - Second Edition

How it works...

WebSockets communication is initiated by the client via the WebSocket class in JavaScript. When a WebSocket instance is created, the client starts the handshake with the server. When the server responds to the handshake and the connection is established, the HTTP connection is then replaced by the WebSocket connection, and it becomes a bidirectional binary protocol not necessarily compatible with HTTP.

WebSockets is plain text, as is HTTP. The server will still require you to implement HTTPS to provide an encrypted layer. If we sniff the communication in the previous exercise with Wireshark, we can easily read the message:

Notice how the messages sent by the client are masked (not encrypted) and the ones from the server are ...