PROFESSIONALCOMMUNITY

WebSockets history

Last updated: July 6, 2023
Read time: 2 Minutes

You can use the WebSockets history to see a record of any WebSocket messages Burp's browser exchanges with web servers. You can use it to view, intercept, and modify the communication between Burp's browser and web servers. This enables you to:

Study the behavior of a target website.
Look for vulnerabilities in WebSockets handshakes and messages.
Send interesting messages to other tools in Burp Suite for further testing.

The WebSockets history contains the following information:

# - The request index number.
URL - The URL of the WebSocket connection.
Direction - The direction of the message (outgoing versus incoming).
Edited - Flag whether the message was modified by the user.
Length - The length of the response in bytes.
Comment - Any user-applied comment.
TLS - Flag whether TLS is used.
Time - The time the message was received.
Listener port - The listener port on which the message was received.
WebSocket ID - Burp's internal ID for the WebSocket that was used for the message.

The WebSockets history is always updated, even if Intercept is off. This enables you to browse without interruption while you monitor key details about application traffic.

Changing the WebSockets history layout

You can customize the WebSockets history layout:

To sort the WebSockets history, click on any column header. You can cycle through ascending, descending, and unsorted.
To reorder the WebSockets history, click and drag a column header.
You can filter the content.
You can add annotations to WebSocket history items.

Viewing a request

If you select an item from the WebSockets history, the lower pane shows the relevant message. Any modified messages are shown separately. The message may have been modified through:

In addition to the main history view, you can also:

Double-click an item to open it in a pop-up window.
Right-click a message and select Show new history window to open a new history window with its own display filter.