Reference project

About LOTWebSockets

A defender-focused catalog of WebSocket endpoints and platforms that adversaries can abuse for command-and-control, tunneling, and exfiltration — modeled after living-off-the-land techniques.

Why this exists

WebSockets blend into normal HTTPS traffic, support long-lived sessions, and often ride on trusted SaaS domains. Blue teams need a single place to see which services show up in abuse research, proofs of concept, and real incidents.

What each entry includes

How to contribute

  1. Fork the repository on GitHub.
  2. Add a new row to the table in index.html (do not edit the CSV by hand).
  3. Open a pull request — CI regenerates data/websockets.csv and updates the entry-count badge.

Stay connected

Meet the people behind the project on the contributors page. Questions and additions are welcome via GitHub pull requests.

Ready to add an entry?

Search the home page first to avoid duplicates, then follow the README contribution steps.

Open on GitHub