{"uuid": "de956eae-3418-4f9f-bb68-80b760efa7e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-32640", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "creation_timestamp": "2026-09-06T11:00:05.719161Z"}