> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/websockets/websocket-message-manipulation.md).
# WebSocket Message Manipulation
WebSocket Message Manipulation notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Manipulating WebSocket Messages to Exploit Vulnerabilities
This online shop has a real-time **chat feature** implemented using **WebSockets**. / Messages sent by the user are displayed instantly in the browser of a **support agent**. / The lab's goal is to **start a `alert()`** popup in the agent browser by manipulating a WebSocket message.
A chat field is available on the app.
By inspecting traffic, messages are sent via WebSocket as follows:
```json
{
"user":"You",
"content":"hi"
}
```
**Filtering test**
Try to send the following payload via the chat:
```javascript
```
Result observed:/ The content is \*\* escaped on the server side\*\* and interpreted as text:
```javascript
<script>alert(0)</script>
```
This indicates the presence of basic filtering against `
