WebSockets on ZAP

WebSocket tab

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket tab

The WebSockets tab displays all messages from WebSocket connections. While ZAP is active, visit e.g.: Mozilla’s BrowserQuest to see WebSockets in action.

Filters

Channel Selector

You can restrict the display of messages to one specific WebSocket channel or all.

WebSocket specific options

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket specific options

This screen allows you to configure the WebSocket options:

Forward all

If you’re not interested in WebSockets communication, but you want to allow its messages being sent back & forth through ZAP, then you should enable this option. As a result no message will be stored in the session database. Moreover no message will appear in the WebSockets tab. This setting can be useful if you have to deal with performance critical WebSocket connections and you’re not interested what is being sent.

WebSocket specific session properties

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket specific session properties

Exclude from WebSocket

This allows you to manage the URLs where WebSocket communication is not processed in ZAP.
Although all messages from excluded URLs are forwarded, nothing is stored nor can you view them in the user interface. This feature is useful for high volume, performance critical WebSocket connections.
You can differentiate on the port for one given domain, by using e.g.: example.com:443 to exclude WebSocket connections from example.com only on port 443.

WebSocket Scripts

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket Scripts

WebSocket Sender

WebSocket Sender scripts are called before forwarding the WebSocket message frame to the server or client and can access and change any WebSocket message that is proxied via ZAP.
They are initially disabled, to enable them right click the relevant script in the Scripts tree and select “enable”.
A template script is provided which gives details of the methods and parameters supported.

WebSocket API

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket API

Views

channels

Returns all of the registered web socket channels.

WebSocket Passive Scan Rules

Mon, 01 Jan 0001 00:00:00 +0000

WebSocket Passive Scan Rules

Scripts

Scripts which are included by default in the add-on and they implement the following WebSocket passive scan rules:

Web Sockets - About

Mon, 01 Jan 0001 00:00:00 +0000

Web Sockets - About

Source Code

https://github.com/zaproxy/zap-extensions/tree/main/addOns/websocket

Authors

ZAP Dev Team