1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
| const express = require('express');
const path = require('path');
const fs = require('fs');
const ws = require('ws');
const app = express();
const HOSTNAME = 'testing.com';
const PORT = 8443;
// TLS Options
const serverOptions = {
cert: fs.readFileSync(path.join(__dirname, 'certs/host.crt')),
key: fs.readFileSync(path.join(__dirname, 'certs/host.key'))
}
const httpServer = require('https').Server(serverOptions, app);
const webSocketServer = new ws.Server({ noServer: true });
// Handle WebSocket Connections (After Upgrade)
webSocketServer.on('connection', (socket, req) => {
console.log('New WebSocket connection', req.socket.remoteAddress);
socket.on('message', (msg) => {
console.log('New MSG:', msg);
socket.send('Received');
});
socket.on('error', (err) => {
console.log('ERROR:', err);
socket.terminate();
});
});
// Handle WebSocket Upgrade
httpServer.on('upgrade', (request, socket, head) => {
// Connection IP
console.log(`Remote Address: ${socket.remoteAddress}`);
// Check the Origin is correct, prevent CSWSH (Cross-Site Web-Socket Hijacking)
if (request.headers.origin === `https://${HOSTNAME}:${PORT}`) {
// Check Cookie is valid here
console.log(request.headers.cookie);
// Upgrade the connection to a WebSocket
webSocketServer.handleUpgrade(request, socket, head, (newSocket) => {
webSocketServer.emit('connection', newSocket, request)
});
} else {
// Origin was incorrect, reject connection
socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
socket.destroy();
}
})
app.get('/', (req, res) => {
res.sendFile(path.join(__dirname, 'index.html'));
});
// Start the Server
httpServer.listen(PORT, () => {
console.log(`[-] Server Listening on Port ${PORT}`);
});
|
