3

Does anyone have a websocket connection working with an application proxy (e.g. burp or zap)?

For example, I have a working version of jWebSockets with works perfectly on my local machine.

However, when I intercept with Burp or Zap the connection times out and I get no server response back.

I have increased the timeout settings on the server side but this does not make a difference.

I have also tried using the invisible proxy option.

Thank you.

RND
  • 31
  • 3
  • 1
    I would be interested in this, too. I tried a similar setup like you with the Apache webserver and mod_proxy, but it was always stripping the _Upgrade_ header sabotaging the handshake between client and server. But I did some research and found some promising solutions. Unfortunately I hadn't had time yet to try any of them. I wrote an article on my blog about this: http://ontraindevelopment.blogspot.de/2012/06/potential-solutions-for-my-reverse.html – Philipp Sep 10 '12 at 09:53

1 Answers1

1

There are very few tools that support web sockets right now as its really a completely new protocol.

The current version of ZAP (1.4.1) wont, but the next major version will: http://code.google.com/p/zaproxy/wiki/GSoC2012_WebSockets

If you can build ZAP from the trunk then it will support web sockets - build instructions here: http://code.google.com/p/zaproxy/wiki/Building

It will allow you to view web socket traffic, intercept and change it and fuzz it to try and find vulnerabilities.

Let us know if you have any problems with it, eg via the ZAP developer group: http://groups.google.com/group/zaproxy-develop

Simon (ZAP Project Lead).

Update - Web Sockets support in ZAP is now available in the weekly cross-platform releases, which can be downloaded from http://code.google.com/p/zaproxy/downloads/list so you dont have to build it yourself

Simon Bennetts
  • 4,070
  • 1
  • 11
  • 20
  • And ZAP version 2.0.0 has now been released (same url as above) which includes WebSockets support. – Simon Bennetts Feb 09 '13 at 12:35
  • Under Scientific Linux 6.7 (like CentOs), using ZAP 2.4.3 and java version "1.8.0_20-ea" I have the same problem, how can I solve it ? – famedoro Feb 22 '16 at 19:11