3 ms·
Anyone come up with good techniques for reverse engineering websockets? Its especially annoying since many use binary message formats and there isnt a great wa
by faizshah 2y ago
Anyone come up with good techniques for reverse engineering websockets?
Its especially annoying since many use binary message formats and there isnt a great way to document an arbitrary binary message protocol.
A couple techniques im trying out:
- websocat and wsrepl for reverse engineering interactively: https://github.com/doyensec/wsrepl https://github.com/doyensec/wsrepl
- kaitai struct for documenting the binary message formats: https://kaitai.io/ https://kaitai.io/
- pimterry 2y agoI'm very interested in this, I do a lot of protocol debugging. Kaitai looks very neat - is that the most popular format for this kind of thing, or are there other popular options I should look at too?
- pdimitar 2y agoJust lately somebody posted about the Imhex tool's DSL: https://xy2i.blogspot.com/2024/11/using-imhexs-pattern-language-to-parse.html https://xy2i.blogspot.com/2024/11/using-imhexs-pattern-langu...
- S0y 2y agoI recently wanted to reverse engineer some Websocket packets for a game I was playing. I used BurpSuite as a proxy to bypass the SSL encryption. It also has a pretty handy tool that will monitor all websocket traffic. After that I used ImHex, pretty much exactly like in that blog to reverse engineer the websocket packets. The DSL is a little finicky but once you wrap your head around it, it`s very nice and powerful.
- pdimitar 2y agoThanks for sharing your experience, it is valuable as I am considering using Imhex and its DSL lately.
- rtrgrd 2y agokind of a tangent but for some services they switch to use http APIs if you disable web sockets which makes it more convenient (cough Microsoft Delve)