WebSocket Server

Sorry, not available in this language yet

English
日本語
简体中文

AI-generated code | Harness the power of AI coding assistants while managing the risks.
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Program Consolidation | Simplify your application security program.
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage Enterprise AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud.
Open Source License Compliance | Effective solutions for ensuring open source license compliance.
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality and Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators.

Static Analysis (SAST) | Analyzing code for security vulnerabilities without executing it.
Software Composition Analysis (SCA) | Analyzing software components for security and license compliance.
Dynamic Analysis (DAST) | Testing running applications for security vulnerabilities.
Interactive Analysis (IAST) | Real-time security testing during application execution.
Penetration Testing | Simulated cyberattacks to identify vulnerabilities.
Mobile Application Security Testing (MAST) | Ensuring the security of mobile applications.
Application Security Posture Management (ASPM) | Managing and improving application security posture.
Fuzz Testing Solutions | Identifying vulnerabilities by inputting random data to applications.

Automotive | Security solutions for automotive industry applications.
Financial Services | Security solutions tailored for financial services.
IoT & Embedded | Security for Internet of Things and embedded systems.
Medical Devices | Security solutions for medical devices.
Public Sector | Security solutions for government and public sector organizations.

Dev and DevOps Teams | Security tools and practices for development and DevOps teams.
Security Teams | Solutions and support for dedicated security teams.
Legal Teams | Resources and compliance tools for legal teams.

WebSocket Server Test Suite Data Sheet

Test Suite:

WebSocket Server Test Suite

Direction:

Server

The WebSocket protocol enables bidirectional, full-duplex communication channel over a single TCP socket. The WebSocket Protocol is designed to work between web browsers and servers, but it can be used in any application. The goal of the WebSocket protocol is to provide a mechanism for applications in web browsers that need two-way communication with servers that does not rely on opening multiple HTTP connections. This test suite can be used to test WebSocket servers for security flaws and robustness problems. The test suite contains test cases for testing WebSocket protocol specific operations like WebSocket Handshake and control frames. Additionally, the test suite can be configured to test web service specific payload which goes over the WebSocket.

Used specifications

Specification

Title

Notes

RFC6455

The WebSocket Protocol

RFC6454

The Web Origin Concept

RFC3986

Uniform Resource Identifier (URI): Generic Syntax

Parts that are needed in WebSocket Handshake

RFC2616

Hypertext Transfer Protocol -- HTTP/1.1

Parts that are needed in WebSocket Handshake

RFC2617

HTTP Authentication: Basic and Digest Access Authentication

Parts that are needed in WebSocket Handshake

Tool-specific information

Tested messages

Specifications

Notes

WebSocket Handshake Request

RFC6455

WebSocket Control Frame - Close

RFC6455

WebSocket Control Frame - Ping

RFC6455

WebSocket Control Frame - Pong

RFC6455

WebSocket Data Frame

RFC6455

Feature

Description

WebSocket payload fuzzing

Payload that goes over WebSocket can be fuzzed.

JSON payload fuzzing

Specific test cases are generated for JSON payload.

Test tool general features

Fully automated black-box negative testing
Ready-made test cases
Written in Java(tm)
GUI command line remote interface modes
Instrumentation (health-check) capability
Support and maintenance
Comprehensive user documentation
Results reporting and analysis