Gone are the days of long polling, bidirectional realtime communication is here via WebSockets. This transformative technology has undeniably elevated the user experience of modern applications, but it poses a critical question: how secure is it? In this talk, we deep-dive into the threat landscape of the WebSocket protocol to discover why this is an often overlooked attack vector where traditional vulnerabilities hide. After providing a primer to the WebSocket protocol and its attack surface, we share our research findings from looking at over 50 enterprise and Open Source applications, unveiling multiple vulnerabilities leading to data leaks, account takeovers and Remote Code Execution. Despite the widespread adoption of WebSockets, WebSocket security remains an underexplored area, presenting unique challenges when evaluating the safety of applications utilizing it. We will address these trials, the shortcomings of current tools, and then reveal our new Burp Suite Extension “SocketSleuth”. SocketSleuth boosts Burp’s WebSocket capabilities, aligning them more closely with the feature set for regular HTTP requests, such as an intruder for WS, match & replace rules, WS AutoRepeater for automated authorization testing, and more! Finally, we show how SocketSleuth can be used to improve pentest workflows and find bugs that have been hiding in realtime!