WS Client

Open your own outbound WebSocket, then craft, replay, and fuzz frames — including raw frames with arbitrary opcodes. (Pro)

WS History shows you the frames a target's page already sent. WS Client is the other half: you open the WebSocket yourself and drive it — craft frames, replay them, fuzz them, and hold the send queue to tamper before a frame leaves. You can also route the socket back through your own Proxy, so your Match & Replace rules, scope, and the Scanner apply to every crafted frame. It's a Pro tool, separate from the always-on capture view.

Open a connection

Each tab is one connection — URL, handshake headers, transport options, and a fuzz config — so you can keep several targets side by side and reopen them later.

1. Set the handshake

   Enter the URL (wss://target/live or ws://127.0.0.1:8080/chat) and add any handshake headers you need — Authorization, Cookie, Origin, a custom subprotocol.

2. Connect

   Click Connect. Frames stream into the log as they arrive, and a status pill tracks the socket: Connecting, Open, Closed, or Error. Disconnect tears the session down; Reconnect re-opens a dropped one. To send a protocol Close frame with a specific code and reason, use the Send pane's Close opcode.

Clone a real session into your socket

Servers gate WebSocket upgrades behind the same Cookie and Authorization the page already holds. Rather than copy them by hand, set the URL, then click Inherit from capture in the handshake-headers panel. Hugin finds the most recent captured WebSocket upgrade to that host and merges its handshake headers into yours, so your crafted socket carries the live session's auth. If Hugin hasn't seen an upgrade to that host yet, it says so — browse the target through the Proxy first, then inherit.

Tune the transport

Open Transport in the toolbar to control how the socket is dialed. Changes apply on the next Connect — the pane is read-only while a session is live — and the button warns whenever any option diverges from the secure default.

Read the handshake response

Once the upgrade completes, the Handshake toolbar button lights up. Open it to see what the server actually negotiated, not just what you offered: the HTTP status line, Sec-WebSocket-Protocol (the subprotocol it picked), Sec-WebSocket- Extensions (for example the agreed permessage-deflate parameters), every response header, and the response body. If a subprotocol or compression you offered is missing here, the server declined it.

Read the frames

The frame log lists each frame by direction (client→server ↑ / server→client ↓), opcode (Text, Binary, Ping, Pong, Close), sequence number, time, size, and payload. Click a frame to expand a hex-and-ASCII view of its payload. The log renders the latest 500 frames; older ones collapse behind a banner so a chatty socket stays readable.

Filter the log by direction, opcode, and a payload search box. Search matches text for Text and Close frames and hex for binary frames, so pasting de ad be ef finds deadbeef. The count shows matched / total.

Every frame row carries Replay (re-send it verbatim) and Edit (load its opcode and payload into the Send pane to mutate, then send). Edit is the fast path from "the server sent something interesting" to "now I tamper with it."

Don't lose frames silently

A busy socket can outrun both the backend buffer and the UI. Three indicators tell you when frames went missing — watch them, because nothing else will.

Send and tamper

The Send panel injects a frame into the live connection. Pick the opcode — Text, Binary, Ping, Pong, or Close. Set the opcode to Binary, Ping, or Pong and an encoding toggle appears:

A Close opcode exposes dedicated code and reason fields. Send Ping fires an empty ping for a liveness check, and for binary-like opcodes Load file reads a file's bytes straight into the payload as hex — throw a binary blob as one frame without leaving the tool.

Turn on Intercept to hold both inbound and outbound frames in a queue and forward, drop, or edit each one before it moves — the same hold-and-tamper loop as the Proxy, but for the frames on this socket. Forward all and Drop all clear the queue in one click.

Export the session

Export writes the session's frames as NDJSON — one JSON object per line, ready to diff, grep, or feed to a script. It's the durable copy of a stream the backend will eventually evict, so export long or high-volume sessions before you close them.

Fuzz a frame

Fuzz drives the Intruder engine against a single frame, so you fuzz a message the same way you fuzz a request. Write a base template — the JSON or text of the frame — and wrap each spot you want to vary in §marker§ pairs. Add one or more payload sets (the same 21 generators as Intruder, from simple lists to brute-force charsets and havoc mutation), pick an attack mode (sniper, battering ram, pitchfork, cluster bomb), and Start. A run needs a live connection, at least one §marker§, and one payload set.

Pace the run with Throttle (ms between sends) and Window (ms to wait for replies after each send) to match a server that answers slowly or rate-limits. Add Grep match patterns (one per line) to flag responses and Grep extract regexes to pull a value out of each reply.

Results stream into a table — payload, what came back, whether a match hit, and any extracted value — refreshing as the run proceeds. A status pill tracks Pending → Running n/total → Done, and you can Pause, Resume, or Cancel mid-run. Use it to walk an ID through a subscribe message, or to throw a payload list at a command field carried over the socket.

Last updated 2026-06-17.