WebSockets history

You can use the WebSockets history to see a record of any WebSocket messages Burp's browser exchanges with web servers. You can use it to view, intercept, and modify the communication between Burp's browser and web servers. This enables you to:

• Study the behavior of a target website.
• Look for vulnerabilities in WebSockets handshakes and messages.
• Send interesting messages to other tools in Burp Suite for further testing.

The WebSockets history contains the following information:

• # - The request index number.
• URL - The URL of the WebSocket connection.
• Direction - The direction of the message (outgoing versus incoming).
• Edited - Flag whether the message was modified by the user.
• Length - The length of the response in bytes.
• Notes - Any user-applied note.
• TLS - Flag whether TLS is used.
• Time - The time the message was received.
• Listener port - The listener port on which the message was received.
• WebSocket ID - Burp's internal ID for the WebSocket that was used for the message.

The WebSockets history is always updated, even if Intercept is off. This enables you to browse without interruption while you monitor key details about application traffic.

Right-click any item in the table to access further options, such as sending requests to other Burp tools.

Changing the WebSockets history layout

You can customize the WebSockets history table in the following ways:

• Hide columns - Right-click the header of the column you want to hide, then select Hide column.

• Show hidden columns - Click the options menu > Table layout, then select the columns you want to display.

• Move columns - Drag and drop the header of the column you want to move to its new location.

• Add custom columns - Click the options menu > Add custom column to create a personalized column that displays the data you want to see. For more information, see Adding custom columns to the WebSockets history.

• Sort the table - Click the header of the column you want to sort by. You can sort by ascending, descending, or unsorted.

• Filter the data - Click the Filter settings bar, then choose either:

  • Settings mode - Use predefined checkboxes and fields to set your criteria. Learn more about filtering the WebSockets history with Settings mode.

  • Script mode - Apply a script to define your custom filter. Learn more about filtering the WebSockets history with scripts.

• Restore the default layout - To return the table to its original state, click the > Table layout, then select Restore default table.

Viewing a request

If you select an item from the WebSockets history, the lower pane shows the relevant message. Any modified messages are shown separately. The message may have been modified through:

• User interception.
• Automatic response modification.
• Match and replace rules.

In addition to the main history view, you can also:

• Double-click an item to open it in a pop-up window.
• Right-click a message and select Show new history window to open a new history window with its own display filter.
• Access the Inspector, to easily view and edit interesting items.
• View and edit notes. To do this, click Notes.