Onboarding

Getting Started

Use the CLI for a quick first pass, Classic for the established workflow, or Electron + Go for bridge-free authorization testing.

01. Install the surface you need

Install Classic Electron + Python for existing project services and the complete web pentest workflow. Install Electron + Go for the private worker, authorization matrices, protected evidence, findings, and retesting.

bash
1pip install wshawk
2 
3# Optional browser runtime for evidence collection
4playwright install chromium

02. Run a quick compatibility scan

The compatibility scanner is still a useful way to sanity-check a WebSocket target before moving into deeper project-backed workflows.

bash
1wshawk ws://target.example/ws

Practical note

Treat scanner output as a starting point. The strongest v4 proof usually comes later from replay, cross-identity comparison, race testing, and evidence review.

03. Start either desktop from source

The same repository contains both desktop editions and their validation tooling.

bash
1git clone https://github.com/regaan/wshawk
2cd wshawk
3pip install -e .
4cd desktop
5npm install
6npm run smoke
7npm start
8 
9# Electron + Go
10cd ../electron-desktop
11npm ci
12npm run build:go
13npm start

04. Use the local validation labs

The repo includes the realtime validation suite plus a loopback-only Electron + Go authorization lab with a scored 34-scenario benchmark.

bash
1./venv/bin/python validation/run_validation.py --list
2./venv/bin/python validation/run_validation.py
bash
1cd electron-desktop
2npm run lab
3npm run test:authorization-benchmark

What to do first in the desktop

Follow the Lifecycle

Create a project, capture traffic, replay actions, then export evidence.

Run the Labs

Use the realtime suite and authorization benchmark to learn the v4.0.4 workflow.

Authorization Workspace

Learn matrices, policies, object discovery, safe writes, findings, and retesting.