WebSocket connection closes when I manipulate BlazorPack messages

[cyberfreaq]

The decoding of the BlazorPack messages works like a charm. However, as soon as I try to manipulate field values within the decoded JSON and send them to the server, the WebSocket connection gets closed and a new one is opened.

I haven't investigated this problem further because I wanted to ask, if it should actually be possible to manipulate BlazorPack messages or if only decoding is supported right now.

[RoganDawes]

It should be possible to modify the messages. However, it wasn't something I actually tested, and I suspect that there may be a checksum somewhere that needs to be updated.

[cyberfreaq]

I see.. I'm afraid I won't have time during this assessment to further look into this but nevertheless I want to thank you for the work you put in and the mallet write-ups and tutorials!

[RoganDawes]

That's a pity. Would have been nice to have solved the mystery. Guess I'll have to poke a bit more on a public site and see what happens!

[GStoynev]

Might be stating something obvious and not related, but Blazor would throw its hands in the air and close the circuit if there's application-level discrepancy. You should be able to see some sort of error in the exchange, if that's the case.

BTW, total newbie in the area - how do I add the blazor groovy to Mallet so I can play with that, too?

[RoganDawes]

Might be stating something obvious and not related, but Blazor would throw its hands in the air and close the circuit if there's application-level discrepancy. You should be able to see some sort of error in the exchange, if that's the case.

Yes, exactly. If you have access to the server side, it might be worth checking for error logs. Whether it is a checksum, or the higher-level code detecting an error condition, the end result is likely to be the same.

It would be useful to have the worlds simplest Server-side blazorpack application, with just a single input field, to make exploration of the protocol a bit easier. Then, once the checksum or whatever has been identified, move up to an input field with validation, and see if it is possible to bypass the validation. etc

[ssstonebraker]

@cyberfreaq are you manipulating them via mallet or burp suite?