Privilege Escalation & WebSocket Security Audit

I need a seasoned security specialist to dive into our online card-and-board-game platform and expose any path an ordinary player might use to escalate privileges through the interface. That is the single most critical outcome of this engagement. While you work, I also want you to examine the WebSocket layer—specifically its data-encryption implementation—to be sure that every message travelling between client and server stays confidential and tamper-proof. You’ll be looking at live traffic the same way a determined attacker would, so expect to spend time in Wireshark or a similar PCAP tool as you capture sessions, replay them, and probe for weaknesses. If deeper packet analysis or anomaly hunting becomes necessary, I’m open to extending the scope, but the first milestone is a clear answer on privilege escalation and encryption strength. Deliverables • A concise report that documents every privilege-escalation vector you discover, the exact request/response sequence that triggers it, and a practical remediation plan. • Your assessment of our WebSocket encryption, including cipher details, key-exchange observations, and proof-of-concept captures. • PCAP files and test scripts you used, clearly commented so my in-house team can reproduce the findings. Acceptance criteria: the report must let a third-party engineer replicate each issue in a fresh environment within 15 minutes and verify that the proposed fix closes the gap. If this sounds familiar territory to you and you’re comfortable alternating between Burp Suite, OWASP ZAP, Wireshark, and raw socket scripts, I’d like to start right away.

Project ID: 40511320