WebSocket and Web App Testing for Stateful Targets
WSHawk v4.0.4 combines the established Electron + Python desktop with a separate bridge-free Electron + Go edition for authorized HTTP, GraphQL, WebSocket, authorization, replay, race, browser-evidence, and web pentest workflows.
$ authorization matrix /auth/resource/{id}
[*] WSHawk v4.0.4
[+] Private Go worker ready over versioned stdio JSON-RPC
[*] Identities: anonymous, user-a, user-b, admin
[+] Object candidates found in path, query, and JSON fields
[!] Horizontal BOLA behavior confirmed on two foreign objects
[*] Secrets redacted; response hashes and replay steps saved
[+] Finding created with stable-ID retesting enabled
Current Capabilities
WSHawk v4.0.4 covers stateful web and realtime testing across two independently packaged desktop editions.
Classic Electron + Python
The established desktop keeps Python project services, CLI integration, traffic, replay, evidence, and the complete web pentest workspace.
Bridge-Free Electron + Go
A separate desktop uses a private Go worker over allowlisted stdio JSON-RPC with no localhost HTTP or Socket.IO bridge.
Authorization Matrix
Test anonymous, User A, User B, and Admin against the same HTTP, GraphQL, WebSocket room, or subscription operation.
Object-ID Discovery
Find identifiers in URL paths, queries, JSON, GraphQL variables, UUIDs, numeric neighbors, and captured project traffic.
Authorization Policies
Evaluate IDOR/BOLA, vertical escalation, missing authentication, BFLA, admin-only, tenant-isolation, and ownership-transfer rules.
Safe Write Testing
POST, PUT, PATCH, and DELETE checks begin as dry runs and add confirmation, strict limits, before/after evidence, cleanup, and rollback verification.
Protected Evidence
Encrypted project storage, automatic secret redaction, hash-only retention, sanitized replay steps, fingerprints, and controlled reveal/copy.
Findings and Retesting
Manage status, severity, confidence, duplicates, evidence previews, selected exports, and five automated retest outcomes.
Industry Validation Lab
Secure and vulnerable HTTP, GraphQL, and WebSocket authorization cases are scored by a 34-scenario benchmark alongside the wider labs.
WSHawk In Practice
Authorization, evidence, and validation workflows available in the Electron + Go edition.
1# Test four access contexts in one campaign2endpoint: GET /auth/resource/resource-b3policy: horizontal_idor4identities: anonymous, user-a, user-b, admin5 6[+] Matrix complete: 4 identities x 1 object7[+] Owner and administrator allowed8[+] Anonymous and foreign user deniedStart with v4.0.4
Choose the desktop edition that matches your workflow, or use the CLI for a fast compatibility pass.
Classic Electron + Python
Established project services, CLI integration, browser companion, replay, race, evidence, and web pentest workflows.
Open v4.0.4 releaseElectron + Go
Bridge-free private worker, authorization matrices, protected evidence, findings, retesting, and native packages.
Open Electron + Go releaseCLI Quick Pass
$ pip install wshawk$ wshawk ws://target.example/ws$ wshawk-defensiveFrequently Asked Questions
What is WSHawk v4.0.4?
WSHawk v4.0.4 is an open-source WebSocket and web application security platform with a compatibility CLI, an established Electron + Python desktop, and a separately packaged Electron + Go desktop.
Which desktop edition should I install?
Choose Classic Electron + Python for established project services, CLI integration, the browser companion, and the complete existing workflow. Choose Electron + Go for bridge-free operation, authorization matrices, protected evidence, findings, and native bounded scanning.
Does the Electron + Go edition need a localhost bridge?
No. Its sandboxed renderer uses allowlisted Electron IPC, and the main process communicates with a private Go worker through versioned stdin/stdout JSON-RPC.
What authorization testing is included?
The Electron + Go edition includes anonymous and multi-identity matrices, IDOR/BOLA, vertical escalation, missing authentication, BFLA, admin-only, tenant-isolation, and ownership-transfer policies with bounded object discovery.
Can it test GraphQL and WebSocket authorization?
Yes. Stored identities can be applied to GraphQL queries and mutations, WebSocket rooms and channels, tenant fields, event replay, and subscriptions. Semantic analysis also handles GraphQL errors and partial data returned with HTTP 200.
How does WSHawk protect saved evidence?
Electron + Go projects use AES-256-GCM content encryption with an operating-system-protected key. Evidence can be redacted, hash-only, retention-limited, and revealed or copied only through explicit controls.
Can saved findings be retested?
Yes. Findings have lifecycle, severity, confidence, duplicate handling, evidence preview, selected export, and stable-ID retesting that classifies results as still vulnerable, fixed, authentication expired, endpoint changed, or inconclusive.
Does v4.0.4 include validation targets?
Yes. Alongside the realtime SaaS, Socket.IO, and GraphQL subscription labs, Electron + Go includes secure and deliberately vulnerable HTTP, GraphQL, and WebSocket authorization cases scored by a 34-scenario benchmark.
What license does WSHawk use?
The current project is released under AGPL-3.0.
WebSocket Security Testing for Stateful Applications
WSHawk v4.0.4 is built for applications where state, identity, asynchronous behavior, and browser-authenticated context matter more than one-shot payload reflection. That makes it useful for chat systems, collaboration platforms, trading interfaces, internal dashboards, subscription APIs, and other realtime SaaS targets.
Two Desktop Editions
The Classic edition combines Electron with Python project services and the established CLI-integrated workflow. The separate Electron + Go edition replaces the network bridge with a private stdio worker and adds bounded native scanning, authorization matrices, encrypted project storage, findings, and automated retesting.
HTTP and WebSocket in the Same Operation Record
Many modern targets mix browser bootstrapping, HTTP APIs, and live WebSocket actions. WSHawk v4 keeps those paths together so operators can capture traffic, replay requests, compare cross-identity behavior, and export evidence from the same workflow instead of bouncing between unrelated tools.
Authorization Matrices and Object Discovery
HTTP, GraphQL, and WebSocket operations can be compared across anonymous, User A, User B, and Admin contexts. WSHawk discovers bounded object candidates in paths, queries, JSON, GraphQL variables, UUIDs, numeric neighbors, and captured project traffic.
Protected and Reproducible Evidence
Electron + Go projects encrypt sensitive content, redact secrets, support hash-only retention, and record sanitized requests, replay instructions, timestamps, identity state, target fingerprints, response hashes, optional screenshots, and cURL reproductions.
Key Capabilities
- Separate Classic Electron + Python and bridge-free Electron + Go releases
- WebSocket replay, AuthZ diff, and race testing
- Authorization matrices and explicit HTTP, GraphQL, and WebSocket policies
- Path, query, JSON, GraphQL, UUID, numeric-neighbor, and captured-ID discovery
- Dry-run and rollback-controlled state-changing authorization tests
- Encrypted projects, redaction, hash-only evidence, and retention controls
- Findings lifecycle, duplicate handling, export, and automated retesting
- A scored 34-scenario authorization lab plus the wider validation suite