> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/websockets/websocket-handshake-manipulation.md).
# WebSocket 握手操纵
WebSocket 握手操纵，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 操纵 WebSocket 握手以利用漏洞
这家网店具有基于……的实时聊天功能 **WebSockets**. / 存在一个 XSS 过滤器：它很严格，但存在可被利用的缺陷。
聊天输入框允许你发送消息，这些消息会在客服人员一侧实时显示。
#### 初始 XSS 过滤测试
将以下载荷发送到聊天中时：
```javascript
```
服务器返回以下消息：
* **检测到攻击：事件处理程序**
* WebSocket 连接会立即 **关闭**.
仅仅重新加载页面后，会出现以下消息：
* **该地址已被列入黑名单**
因此，该 IP 地址被临时阻止。
#### 绕过黑名单
在建立 WebSocket 握手时添加以下 HTTP 头：
```http
X-Forwarded-For: 0.0.0.0
```
服务器再次接受了连接。/ 为了避免每次都手动添加，这个头被配置为 **在代理中永久配置**.
#### 绕过 XSS 过滤器
连接恢复后，对载荷稍作修改以绕过过滤器：
```javascript
```
这种断裂和语法变化使其能够绕过检测。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/websockets/websocket-handshake-manipulation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
