WebSockets Vulnerabilities

Cross-platform resources for WebSockets Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice WebSockets Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 5 challenges across 3 platforms — 1 HackTheBox · 2 PortSwigger · 2 TryHackMe. 1 with a Spanish writeup, 1 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Manipulating WebSocket messages to exploit vulnerabilities (Apprentice) · 🇬🇧
2. PortSwigger — Manipulating the WebSocket handshake to exploit vulnerabilities (Practitioner) · 🇬🇧
3. TryHackMe — AWS API Gateway (Medium · ~50 min) · 🇬🇧
4. TryHackMe — Request Smuggling: WebSockets (Medium · ~30 min) · 🇬🇧
5. HackTheBox — MultiMaster (Insano) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/websockets

HTB machines practicing WebSockets Vulnerabilities (1)

Machine	OS	Difficulty	Writeup
MultiMaster	Windows	INSANE	🇪🇸 🇬🇧 📹

PortSwigger labs practicing WebSockets Vulnerabilities (2)

Lab	Difficulty	Topic	Official
Manipulating WebSocket messages to exploit vulnerabilities	APPRENTICE	WebSockets	Open
Manipulating the WebSocket handshake to exploit vulnerabilities	PRACTITIONER	WebSockets	Open

TryHackMe rooms practicing WebSockets Vulnerabilities (2)

Room	Difficulty	Type	Access	Official
AWS API Gateway	MEDIUM	Walkthrough	🟢 Free	Open
Request Smuggling: WebSockets	MEDIUM	Walkthrough	🔵 VIP	Open

---

← Back to the full glossary

Last updated: 2026-08-17