Controlled exercise
Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
01
Send the secure foreign-room request
Connect as User A and send a subscription for room user_b in secure mode.
{"action":"subscribe","room":"user_b","mode":"secure"}Expected result
A denied frame names user_b and secure-room-ownership.
02
Establish owner behavior
Replay the identical frame as User B. The owner should receive subscribed and private room evidence.
03
Test the vulnerable mode
Replay as User A after changing only mode to insecure. Confirm the response includes owner user_b and user_b-private-websocket-evidence.
{"action":"subscribe","room":"user_b","mode":"insecure"}04
Confirm the reverse direction
Use User B against room user_a. Two foreign-room confirmations support higher confidence than one isolated frame.
Prove it before moving on.
Your timeline proves two foreign-room exposures and includes attacker, owner, request, response, and frame hashes.