SlideShare a Scribd company logo
1 of 28
Download to read offline
HACKING WEBSOCKETS
FOR FUN AND PROFIT
@tomekcejner 2015 / SmartRecruiters Inc.
WHAT
REALTIME COMMUNICATION
FULL DUPLEX
LOW LATENCY
FOR
SOCIAL FEEDS
CHAT
COMMON EDITING
MONITORING
COMPARING TECHNIQUES
BROWSER SERVER
POLLING
BROWSER SERVER
EVENT
EVENT
POLLING
SIMPLE ALWAYS WORKS
HIGH TRAFFIC
HIGH LATENCY
LONG POLLING
BROWSER SERVER
EVENT
LONG POLLING
NEAR-REALTIME
VERY LONG REQUESTS
WILL BLOCK THREADS
NEEDS STICKY LOADBALANCING
STREAMING
BROWSER SERVER
EVENT
EVENT
RESPONSE PART
RESPONSE PART
STREAMING
NEAR REALTIME
BUFFERING PROXY WILL RUIN
WEBSOCKETS
BROWSER SERVER
EVENT
EVENT
UPGRADE
WEBSOCKETS
REALTIME
DUPLEX
SUPPORTED BY LATEST BROWSERS
MAY BE BROKEN BY SOME PROXIES
CAN I USE?
http://caniuse.com/#feat=websockets
WEBSOCKETS API
var socket = new WebSocket('ws://game.example.com:12010/updates');
socket.onopen = function () {
setInterval(function() {
if (socket.bufferedAmount == 0)
socket.send(getUpdateData());
}, 50);
};
EMITTING MESSAGES
SEND TEXT OR BINARY FRAME
LOW OVERHEAD: 2 BYTES PER FRAME
TEXT FRAME
0x81 0x05 0x48 0x65 0x6c 0x6c 0x6f
H e l l o
JAVASCRIPT WEBSOCKETS
FRAMEWORK
CLIENT WITH FALLBACKS
NODE.JS SERVER
CODE
var app = require('express')();
var server = require('http').Server(app);
var io = require('socket.io')(server);
server.listen(80);
app.get('/', function (req, res) {
res.sendfile(__dirname + '/index.html');
});
io.on('connection', function (socket) {
socket.emit('news', { hello: 'world' });
socket.on('my other event', function (data) {
console.log(data);
});
});
<script src="/socket.io/socket.io.js"></script>
<script>
var socket = io.connect('http://localhost');
socket.on('news', function (data) {
console.log(data);
socket.emit('my other event', { my: 'data' });
});
</script>
CLIENTSERVER
CHALLENGES
STATEFULNESS
SCALABILITY
BROADCASTING
BROADCASTING
io.on('connection', function(socket){
socket.join('some room');
});
io.to('some room').emit('some event'):
io.on('connection', function(socket){
socket.on('say to someone', function(id, msg){
socket.broadcast.to(id).emit('my message', msg);
});
});
MULTIPLE NODES
Node A
CLIENT 1
CLIENT 2
Node B
CLIENT 3
CLIENT 4
?
SCALING
https://github.com/socketio/socket.io-redis
RESOURCES
http://socket.io

Socket.IO Swift client
https://github.com/socketio/socket.io-client-swift

BeneïŹts of Web Sockets
https://www.websocket.org/quantum.html

Web Sockets API
http://dev.w3.org/html5/websockets/

Web Sockets RFC
https://tools.ietf.org/html/rfc6455

DiïŹ€erence between polling, long polling and web sockets explained:
http://stackoverïŹ‚ow.com/questions/10028770/html5-websocket-vs-long-polling-vs-ajax-
vs-webrtc-vs-server-sent-events

http://stackoverïŹ‚ow.com/questions/11077857/what-are-long-polling-websockets-server-
sent-events-sse-and-comet
THANK YOU
That’s all
BONUS CONTENT
TRACKING USERS IN REDS
SADD mob:online:7501234 55e83ebae4b00f589364debd
SISMEMBER mob:online:7501234 55e83ebae4b00f589364debd
SMEMBERS mob:online:7501234

More Related Content

Viewers also liked

Real-time Web Application with Socket.IO, Node.js, and Redis
Real-time Web Application with Socket.IO, Node.js, and RedisReal-time Web Application with Socket.IO, Node.js, and Redis
Real-time Web Application with Socket.IO, Node.js, and Redis
York Tsai
 

Viewers also liked (8)

Redis : Database, cache, pub/sub and more at Jelly button games
Redis : Database, cache, pub/sub and more at Jelly button gamesRedis : Database, cache, pub/sub and more at Jelly button games
Redis : Database, cache, pub/sub and more at Jelly button games
 
laravel websocket(use redis pubsub) [Laravel meetup tokyo]
laravel websocket(use redis pubsub) [Laravel meetup tokyo]laravel websocket(use redis pubsub) [Laravel meetup tokyo]
laravel websocket(use redis pubsub) [Laravel meetup tokyo]
 
Web Sockets - HTML5
Web Sockets - HTML5Web Sockets - HTML5
Web Sockets - HTML5
 
Transforming WebSockets
Transforming WebSocketsTransforming WebSockets
Transforming WebSockets
 
The State of WebSockets in Django
The State of WebSockets in DjangoThe State of WebSockets in Django
The State of WebSockets in Django
 
Websocket + Redis pubsub
Websocket + Redis pubsubWebsocket + Redis pubsub
Websocket + Redis pubsub
 
Real-time Web Application with Socket.IO, Node.js, and Redis
Real-time Web Application with Socket.IO, Node.js, and RedisReal-time Web Application with Socket.IO, Node.js, and Redis
Real-time Web Application with Socket.IO, Node.js, and Redis
 
Real Time Recommendations Using WebSockets and Redis - Ninad Divadkar, Inuit
Real Time Recommendations Using WebSockets and Redis - Ninad Divadkar, InuitReal Time Recommendations Using WebSockets and Redis - Ninad Divadkar, Inuit
Real Time Recommendations Using WebSockets and Redis - Ninad Divadkar, Inuit
 

Similar to Hacking websockets

WebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
WebSockets: The Current State of the Most Valuable HTML5 API for Java DevelopersWebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
WebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
Viktor Gamov
 
SignalR + Mobile Possibilities
SignalR + Mobile PossibilitiesSignalR + Mobile Possibilities
SignalR + Mobile Possibilities
Sam Basu
 

Similar to Hacking websockets (20)

Cloud computing for libraries an introduction
Cloud computing for libraries an introductionCloud computing for libraries an introduction
Cloud computing for libraries an introduction
 
Loosely or lousily coupled - Understanding communication patterns in microser...
Loosely or lousily coupled - Understanding communication patterns in microser...Loosely or lousily coupled - Understanding communication patterns in microser...
Loosely or lousily coupled - Understanding communication patterns in microser...
 
2nd AMIMOTO: WordPress + Amazon Web Services Singapore
2nd AMIMOTO: WordPress + Amazon Web Services Singapore2nd AMIMOTO: WordPress + Amazon Web Services Singapore
2nd AMIMOTO: WordPress + Amazon Web Services Singapore
 
Twilio Signal 2016 Best Practices for Debugging Twilio Apps
Twilio Signal 2016 Best Practices for Debugging Twilio AppsTwilio Signal 2016 Best Practices for Debugging Twilio Apps
Twilio Signal 2016 Best Practices for Debugging Twilio Apps
 
🚀 Here some of those tools which we have used in most web3.0 mobile app devel...
🚀 Here some of those tools which we have used in most web3.0 mobile app devel...🚀 Here some of those tools which we have used in most web3.0 mobile app devel...
🚀 Here some of those tools which we have used in most web3.0 mobile app devel...
 
Future of Web Apps - Giving Customer Support using WebRTC
Future of Web Apps - Giving Customer Support using WebRTCFuture of Web Apps - Giving Customer Support using WebRTC
Future of Web Apps - Giving Customer Support using WebRTC
 
WebRTC - On Standards, Identity and Telco Strategy
WebRTC - On Standards, Identity and Telco StrategyWebRTC - On Standards, Identity and Telco Strategy
WebRTC - On Standards, Identity and Telco Strategy
 
WebRTC Reborn - Full Stack
WebRTC Reborn  - Full StackWebRTC Reborn  - Full Stack
WebRTC Reborn - Full Stack
 
WebRTC Reborn Over The Air
WebRTC Reborn Over The AirWebRTC Reborn Over The Air
WebRTC Reborn Over The Air
 
The End of server management - Continuous delivery meetup Paris
The End of server management  - Continuous delivery meetup ParisThe End of server management  - Continuous delivery meetup Paris
The End of server management - Continuous delivery meetup Paris
 
The State of WebRTC
The State of WebRTCThe State of WebRTC
The State of WebRTC
 
The End of server management - Opening keynote Lux i/o 2016
The End of server management - Opening keynote Lux i/o 2016The End of server management - Opening keynote Lux i/o 2016
The End of server management - Opening keynote Lux i/o 2016
 
JAX 2022 - Loosely or lousily coupled
JAX 2022 - Loosely or lousily coupledJAX 2022 - Loosely or lousily coupled
JAX 2022 - Loosely or lousily coupled
 
Boosting business with WebRTC - ClueCon 2017
Boosting business with WebRTC - ClueCon 2017Boosting business with WebRTC - ClueCon 2017
Boosting business with WebRTC - ClueCon 2017
 
WebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
WebSockets: The Current State of the Most Valuable HTML5 API for Java DevelopersWebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
WebSockets: The Current State of the Most Valuable HTML5 API for Java Developers
 
It automation & devops - devopsdays istambul 2016
It automation & devops -  devopsdays istambul 2016It automation & devops -  devopsdays istambul 2016
It automation & devops - devopsdays istambul 2016
 
WebSockets On Fire
WebSockets On FireWebSockets On Fire
WebSockets On Fire
 
Web sockets - Pentesting
Web sockets - Pentesting Web sockets - Pentesting
Web sockets - Pentesting
 
SignalR + Mobile Possibilities
SignalR + Mobile PossibilitiesSignalR + Mobile Possibilities
SignalR + Mobile Possibilities
 
WebRTC: A front-end perspective
WebRTC: A front-end perspectiveWebRTC: A front-end perspective
WebRTC: A front-end perspective
 

Recently uploaded

%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
masabamasaba
 
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
masabamasaba
 
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
masabamasaba
 

Recently uploaded (20)

WSO2CON 2024 - Navigating API Complexity: REST, GraphQL, gRPC, Websocket, Web...
WSO2CON 2024 - Navigating API Complexity: REST, GraphQL, gRPC, Websocket, Web...WSO2CON 2024 - Navigating API Complexity: REST, GraphQL, gRPC, Websocket, Web...
WSO2CON 2024 - Navigating API Complexity: REST, GraphQL, gRPC, Websocket, Web...
 
%in Midrand+277-882-255-28 abortion pills for sale in midrand
%in Midrand+277-882-255-28 abortion pills for sale in midrand%in Midrand+277-882-255-28 abortion pills for sale in midrand
%in Midrand+277-882-255-28 abortion pills for sale in midrand
 
WSO2Con2024 - From Blueprint to Brilliance: WSO2's Guide to API-First Enginee...
WSO2Con2024 - From Blueprint to Brilliance: WSO2's Guide to API-First Enginee...WSO2Con2024 - From Blueprint to Brilliance: WSO2's Guide to API-First Enginee...
WSO2Con2024 - From Blueprint to Brilliance: WSO2's Guide to API-First Enginee...
 
Announcing Codolex 2.0 from GDK Software
Announcing Codolex 2.0 from GDK SoftwareAnnouncing Codolex 2.0 from GDK Software
Announcing Codolex 2.0 from GDK Software
 
WSO2CON 2024 Slides - Open Source to SaaS
WSO2CON 2024 Slides - Open Source to SaaSWSO2CON 2024 Slides - Open Source to SaaS
WSO2CON 2024 Slides - Open Source to SaaS
 
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
 
WSO2CON 2024 - Does Open Source Still Matter?
WSO2CON 2024 - Does Open Source Still Matter?WSO2CON 2024 - Does Open Source Still Matter?
WSO2CON 2024 - Does Open Source Still Matter?
 
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park %in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
 
What Goes Wrong with Language Definitions and How to Improve the Situation
What Goes Wrong with Language Definitions and How to Improve the SituationWhat Goes Wrong with Language Definitions and How to Improve the Situation
What Goes Wrong with Language Definitions and How to Improve the Situation
 
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital TransformationWSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
WSO2Con2024 - WSO2's IAM Vision: Identity-Led Digital Transformation
 
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
 
WSO2Con2024 - GitOps in Action: Navigating Application Deployment in the Plat...
WSO2Con2024 - GitOps in Action: Navigating Application Deployment in the Plat...WSO2Con2024 - GitOps in Action: Navigating Application Deployment in the Plat...
WSO2Con2024 - GitOps in Action: Navigating Application Deployment in the Plat...
 
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
Direct Style Effect Systems -The Print[A] Example- A Comprehension AidDirect Style Effect Systems -The Print[A] Example- A Comprehension Aid
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
 
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
 
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
Abortion Pills In Pretoria ](+27832195400*)[ đŸ„ Women's Abortion Clinic In Pre...
 
WSO2CON2024 - It's time to go Platformless
WSO2CON2024 - It's time to go PlatformlessWSO2CON2024 - It's time to go Platformless
WSO2CON2024 - It's time to go Platformless
 
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...
 
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
%in Bahrain+277-882-255-28 abortion pills for sale in Bahrain
 
Artyushina_Guest lecture_YorkU CS May 2024.pptx
Artyushina_Guest lecture_YorkU CS May 2024.pptxArtyushina_Guest lecture_YorkU CS May 2024.pptx
Artyushina_Guest lecture_YorkU CS May 2024.pptx
 

Hacking websockets