ROT HACKERSACADEMYStart learning
Courses/WebSocket Fieldwork/Lesson 03
03.03 / 50 min

Test subscriptions and event replay

Determine whether an authenticated identity can replay an event belonging to another channel or owner.

By the endReplay a captured event requestKeep channel mutation explicitSeparate duplicate events from unauthorized events
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Capture an owner event

As User B, send a secure event_replay request for room user_b and save both the request and returned event.

{"action":"event_replay","room":"user_b","mode":"secure"}
02

Replay under the attacker

Apply User A to the saved request without changing the room. Secure mode must deny it.

03

Exercise the intentional flaw

Change mode to insecure and replay as User A. Compare the owner field and secret against the original User B event.

Expected result

User A receives an event owned by user_b.

04

Document subscription abuse

Record whether unauthorized access occurs during subscribe, event replay, or both. Do not label a harmless duplicate delivery as authorization failure unless foreign data is exposed.

MASTERY CHECKPOINT

Prove it before moving on.

The finding states the exact action that bypassed authorization and the owner data it returned.