WebSocket Inspector

The WebSocket inspector connects to a ws:// or wss:// endpoint, performs the upgrade handshake, and reports what the server accepted. Optionally it sends a single test frame and reports the response.

WebSockets are how modern web apps push real-time data — chat, trading interfaces, live notifications, collaborative editing. From an investigation standpoint, knowing whether and how a site exposes WebSocket endpoints tells you which capabilities the site offers without you needing to log in.

What you get

Why probe WebSocket endpoints

A few investigative scenarios:

• Mapping app capabilities. A /api/notifications WebSocket suggests real-time notifications. A /ws/trading endpoint suggests a live-data feed. Knowing what is exposed tells you what the app does.
• Origin checks for CSWSH (cross-site WebSocket hijacking). A WebSocket that accepts cross-origin connections without authentication is a classic finding. The Origin-bypass test surfaces this directly.
• Detection evasion. Some sites deliberately advertise WebSocket endpoints they do not actually serve. The handshake response is the truth.

Subprotocol negotiation

The client offers a list of subprotocols (Sec-WebSocket-Protocol); the server picks one or none. Subprotocols often advertise the application:

• mqtt — MQTT messaging.
• graphql-ws — GraphQL over WebSocket.
• ocpp1.6 — Open Charge Point Protocol (EV charging stations).
• Custom strings — application-specific protocols.

A surprising number of WebSocket endpoints accept any subprotocol the client offers, which is a misconfiguration but useful for fingerprinting.

Extension parameters

Sec-WebSocket-Extensions carries compression and other extensions. The most common is permessage-deflate, often with parameters that encode the server's compression configuration. The tool parses and surfaces:

• client_max_window_bits / server_max_window_bits.
• client_no_context_takeover / server_no_context_takeover.

Useful for performance tuning and, occasionally, for fingerprinting the server stack.

Origin bypass test

A toggle re-runs the handshake without the Origin header. If the server still accepts the connection, the WebSocket may be vulnerable to cross-site hijacking — an attacker page can open the WebSocket on the user's behalf and impersonate them.

Echo frame test

A toggle sends a single text frame ({"ping":1} by default; configurable) and waits for a response. The tool surfaces:

• Whether the server responded.
• Whether the server immediately closed the connection (with the close code).
• The first response frame's payload (truncated to a sensible size).

For applications with simple echo or ping-pong protocols, this confirms the endpoint is alive end-to-end.

Pivots

Sources

• Direct WebSocket handshake against the target endpoint.
• TLS handshake against the underlying TLS connection (for wss://).

No external API is queried for this tool.