Documentation | WSHawk v4

What v4 Optimizes For

Traffic, identities, notes, findings, and exports stay together in one local project.

Replay, AuthZ diff, and race testing matter more than a one-shot scanner when the target is stateful.

Encryption, redaction, hashes, retention controls, replay steps, and stable retesting keep findings reproducible.

Bridge-free architecture, install choices, workspaces, protected projects, native packages, and build commands.

Matrices, policies, object discovery, semantic analysis, safe writes, GraphQL, WebSocket, findings, and retesting.

How projects, capture, replay, diffing, race testing, and exports fit together.

Install WSHawk, choose the right surface, and start with the recommended v4 path.

How WSHawk infers message families, fields, protocol hints, and likely attack paths.

Where payload mutation still helps and where replay, AuthZ diff, and race become the stronger proof path.

Using callback-based detection for SSRF, XXE, and similar out-of-band behavior.

What the Playwright-assisted evidence path does and what it does not claim.

The main issue classes WSHawk is good at proving in v4.

Longer v4.0.4 guides for both desktops, authorization, evidence, validation, and release history.

Command	Description
`wshawk ws://target.example/ws`	Run the compatibility scanner for a fast first pass.
`wshawk-interactive`	Open the interactive CLI workflow.
`wshawk-advanced ws://target.example/ws`	Use the advanced legacy CLI path with more scanner-side controls.
`wshawk-defensive`	Run the narrow defensive helper checks that still ship with the project.
`cd desktop && npm run smoke`	Run the Classic Electron + Python sanity check.
`cd electron-desktop && npm run test:all`	Run Electron + Go unit, Go worker, parity, Electron E2E, and authorization checks.
`npm run test:authorization-benchmark`	Score the 34 secure and deliberately vulnerable authorization scenarios.