{"vulnerability": "CVE-2020-2781", "sightings": [{"uuid": "53c9dfef-0f92-4181-9b76-8b0b903c2cc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27813", "type": "seen", "source": "https://t.me/codeby_sec/9952", "content": "\ud83c\udf10STEWS \u2014 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f WebSockets.\n\n\ud83c\udfaf\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438\n\u23fa\ufe0f\u041d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a WebSockets, \u043f\u0443\u0442\u0435\u043c \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0447\u043d\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e ZGrab2 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 URL-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 WebSocket \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f WebSocket.\n\n\u23fa\ufe0f\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435, \u043a\u0430\u043a\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 WebSockets \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435: \n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u0438\u044f \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 WebSocket, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b WebSocket. STEWS \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a\u0430\u043a \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f WebSocket (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP), \u0442\u0430\u043a \u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WebSocket (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 WebSocket).\n\n\u23fa\ufe0f\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430, \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 WebSockets \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c CVE \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c WebSockets: CSWSH (\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0445 \u0432\u0435\u0431-\u0441\u043e\u043a\u0435\u0442\u043e\u0432), CVE-2020-27813,CVE-2020-7662 \u0438 CVE-2020-7663, CVE-2021-32640.\n\n\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 WebSockets\u2753\nWebSocket \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c. \u0414\u0430\u043d\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0431\u0435\u0437 \u0437\u0430\u0434\u0435\u0440\u0436\u0435\u043a - \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u0447\u0430\u0442\u0435 \u043f\u0440\u0438\u0445\u043e\u0434\u044f\u0442 \u0441\u0440\u0430\u0437\u0443, \u0430 \u0438\u0433\u0440\u043e\u0432\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \u041f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 WebSocket \u0441\u0442\u0430\u043b\u043e \u043f\u0440\u043e\u0440\u044b\u0432\u043e\u043c \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0433\u0434\u0435 \u0432\u0430\u0436\u043d\u0430 \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u0430\u044f \u0440\u0435\u0430\u043a\u0446\u0438\u044f.\n\n\u27a1\ufe0f\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0421\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 WebSocket \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a Upgrade,\u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0449\u0438\u0439 \u043e \u0436\u0435\u043b\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Websocket. \u042d\u0442\u043e\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f Websocket-handshake\n \n\u27a1\ufe0f\u041e\u0431\u043c\u0435\u043d \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u201c\u0440\u0443\u043a\u043e\u043f\u043e\u0436\u0430\u0442\u0438\u044f\u201d \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0432 \u043e\u0431\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\n1\ufe0f\u20e3\u041f\u043e\u0438\u0441\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0432\u044b\u0431\u043e\u0440 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u0441\u0442\u043e\u0432. \u041d\u0438\u0436\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0432\u044b\u0431\u043e\u0440 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0433\u043e \u0442\u0435\u0441\u0442\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 CVE-2020-27813. \npython3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084\n\n2\ufe0f\u20e3\u0417\u0430\u043f\u0443\u0441\u043a \u0432\u0441\u0435\u0445 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c -a \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u043e\u0447\u043d\u043e\u0435 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043f\u0435\u0447\u0430\u0442\u043a\u043e\u0432, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043d\u044f\u0442\u044c \u043c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0431\u044a\u0435\u043c\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0441\u043d\u044f\u0442\u0438\u0435 \u043e\u0442\u043f\u0435\u0447\u0430\u0442\u043a\u0430.\npython3 STEWS-fingerprint.py -1 -k -u streamer.finance.yahoo.com\n\n3\ufe0f\u20e3\u0414\u043b\u044f \u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a WebSockets \u0432 \u0444\u0430\u0439\u043b\u0435 known-endpoints.txt \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u0434\u043e\u043c\u0435\u043d\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439.\nSTEWS-discovery.sh\n\n#tools #websockets #network\n\n\ud83d\udd17 \u0412\u0441\u0435 \u043d\u0430\u0448\u0438 \u043a\u0430\u043d\u0430\u043b\u044b \ud83d\udd01 \u0412\u0441\u0435 \u043d\u0430\u0448\u0438 \u0447\u0430\u0442\u044b \ud83e\udea7 \u0414\u043b\u044f \u0441\u0432\u044f\u0437\u0438 \u0441 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c", "creation_timestamp": "2026-04-07T15:02:10.000000Z"}, {"uuid": "be8be518-7ce3-4959-afc1-6827f6905790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27818", "type": "published-proof-of-concept", "source": "Telegram/5lwIiVRlGValAb7a3y7unGCeHw0VejzNjVdua0u49Ev9FgE", "content": "", "creation_timestamp": "2025-01-20T16:00:09.000000Z"}, {"uuid": "ed50b2ae-faf2-4187-9486-9e6bb3971cd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27819", "type": "seen", "source": "https://t.me/cibsecurity/23972", "content": "\u203c CVE-2020-27819 \u203c\n\nAn issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exists when parsing XLS cells in libxls/xls2csv.c:199. It could allow a remote attacker to cause a denial of service via crafted XLS file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-23T07:34:22.000000Z"}, {"uuid": "f97c30d1-388c-4565-8642-ea7702beeb30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27818", "type": "seen", "source": "https://t.me/cibsecurity/17226", "content": "\u203c CVE-2020-27818 \u203c\n\nA flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-08T07:30:36.000000Z"}, {"uuid": "e8e58aee-5b39-495e-8d78-0772d9ab8dc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27813", "type": "seen", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "creation_timestamp": "2026-09-01T20:01:57.904249Z"}, {"uuid": "93d6a791-c529-47f7-8044-27af34bba14f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27813", "type": "seen", "source": "https://t.me/hacking_Attack/41068", "content": "verbose tracing of communications\n-d, \u2013debug Print each test case to track progress while running\n-u URL, \u2013url URL URL to connect to\n-f FILE, \u2013file FILE File containing URLs to check for valid WebSocket connections\n-n, \u2013no-encryption Connect using ws://, not wss:// (default is wss://)\n-k, \u2013nocert Ignore invalid SSL cert\n-o ORIGIN, \u2013origin ORIGIN\nSet origin\n-1 Test for generic Cross-site WebSocket Hijacking (CSWSH)\n-2 Test CVE-2021-32640 \u2013 ws Sec-Websocket-Protocol Regex DoS\n-3 Test CVE-2020-7662 & 7663 \u2013 faye Sec-WebSocket-Extensions Regex DoS\n-4 Test CVE-2020-27813 \u2013 Gorilla DoS Integer Overflow\n\nTest 1 provides a generic CSWSH test. This can be used in combination with the -oflag to specify a specific origin to attempt to bypass any server-side checks.\n\nTests 2, 3, and 4 check for specific CVEs. The test cases for these were created based on the PoC code published as part of the discovery of these CVEs. For example, to run test 4 on a local server on port 8084, you can run: python3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084Why this tool?\n\nWebSocket servers have been largely ignored in security circles. This is partially due to three hurdles that have not been clearly addressed for WebSocket endpoints:\n\n* Discovery\n* Enumeration/fingerprinting\n* Vulnerability detecting\n\nSTEWS attempts to address these three points. A custom tool was required because there is a distinct lack of support for manually configured WebSocket testing in current security testing tools:\n\n* There is a general lack of supported and scriptable Web Socket security testing tools (for example, NCC\u2019s unsupported\u00a0wssip tool,\u00a0nuclei\u2019s lack of Web Socket support, and\u00a0nmap\u2019s lack of Web Socket support)\n* Burp Suite lacks support for Web Socket extensions (for example, see\u00a0this Port Swigger forum thread\u00a0and\u00a0this one).\n* There is a lack of deeper Web Socket-specific security research (the\u00a0Awesome Web Socket Security repository\u00a0lists published Web Sockets security research)\n* The proliferation of Web Sockets around the modern web (as seen in the results of the STEWS discovery tool) Download", "creation_timestamp": "2026-09-01T20:01:57.715805Z"}, {"uuid": "8623ccdc-7ab0-460f-ba60-4aeecf6fe5c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27813", "type": "seen", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "creation_timestamp": "2026-09-02T01:02:20.231148Z"}, {"uuid": "82866354-d73a-4916-831c-1a72ad7a9273", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27813", "type": "seen", "source": "https://t.me/hacking_Attack/41068", "content": "verbose tracing of communications\n-d, \u2013debug Print each test case to track progress while running\n-u URL, \u2013url URL URL to connect to\n-f FILE, \u2013file FILE File containing URLs to check for valid WebSocket connections\n-n, \u2013no-encryption Connect using ws://, not wss:// (default is wss://)\n-k, \u2013nocert Ignore invalid SSL cert\n-o ORIGIN, \u2013origin ORIGIN\nSet origin\n-1 Test for generic Cross-site WebSocket Hijacking (CSWSH)\n-2 Test CVE-2021-32640 \u2013 ws Sec-Websocket-Protocol Regex DoS\n-3 Test CVE-2020-7662 & 7663 \u2013 faye Sec-WebSocket-Extensions Regex DoS\n-4 Test CVE-2020-27813 \u2013 Gorilla DoS Integer Overflow\n\nTest 1 provides a generic CSWSH test. This can be used in combination with the -oflag to specify a specific origin to attempt to bypass any server-side checks.\n\nTests 2, 3, and 4 check for specific CVEs. The test cases for these were created based on the PoC code published as part of the discovery of these CVEs. For example, to run test 4 on a local server on port 8084, you can run: python3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084Why this tool?\n\nWebSocket servers have been largely ignored in security circles. This is partially due to three hurdles that have not been clearly addressed for WebSocket endpoints:\n\n* Discovery\n* Enumeration/fingerprinting\n* Vulnerability detecting\n\nSTEWS attempts to address these three points. A custom tool was required because there is a distinct lack of support for manually configured WebSocket testing in current security testing tools:\n\n* There is a general lack of supported and scriptable Web Socket security testing tools (for example, NCC\u2019s unsupported\u00a0wssip tool,\u00a0nuclei\u2019s lack of Web Socket support, and\u00a0nmap\u2019s lack of Web Socket support)\n* Burp Suite lacks support for Web Socket extensions (for example, see\u00a0this Port Swigger forum thread\u00a0and\u00a0this one).\n* There is a lack of deeper Web Socket-specific security research (the\u00a0Awesome Web Socket Security repository\u00a0lists published Web Sockets security research)\n* The proliferation of Web Sockets around the modern web (as seen in the results of the STEWS discovery tool) Download", "creation_timestamp": "2026-09-02T01:02:20.116164Z"}]}