Workflow Gallery

Current v4.0.4 Scenarios

Example operations that match the actual WSHawk v4 workflow model.

Four-Identity Authorization Matrix

Authorization

Compare anonymous, User A, User B, and Admin behavior against the same resource operation.

bash
1GET /auth/resource/resource-b
2policy: horizontal_idor
3identities: anonymous, user-a, user-b, admin
4 
5# Expected secure matrix
6# anonymous: 401
7# user-a: 403
8# user-b: 200
9# admin: 200

Automatic Object Candidate Discovery

Objects

Discover bounded identifiers in paths, queries, JSON bodies, GraphQL variables, and captured traffic.

bash
1POST /users/123/orders/456?account_id=123
2{
3  "document_id": "8aa3f0d1-..."
4}
5 
6# Candidates
7# path: 123, 456
8# query: account_id=123
9# json: document_id=<uuid>

GraphQL Partial-Data Authorization

GraphQL

Detect sensitive data returned with GraphQL errors even when the transport status remains HTTP 200.

bash
1query Document($documentId: ID!) {
2  document(id: $documentId) { id owner secret }
3}
4 
5# Semantic result
6# status: 200
7# graphql_errors: true
8# partial_sensitive_data: true
9# authorization_difference: high

Saved-Finding Retest

Retest

Re-run stable finding evidence after a fix and classify the outcome without losing the original record.

bash
1finding: authz_7a3f...
2action: retest
3 
4# Outcomes
5# still_vulnerable | fixed
6# authentication_expired
7# endpoint_changed | inconclusive

Cross-Identity WebSocket AuthZ Diff

AuthZ

Compare the same WebSocket action across two stored identities and review the grouped behavioral differences.

bash
1POST /platform/projects/{project}/attacks/authz-diff
2{
3  "baseline_identity_id": "tenant-admin",
4  "candidate_identity_id": "tenant-user",
5  "message_family": "invoice.subscribe"
6}
7 
8# Output
9# difference_count: 1
10# finding: candidate received cross-tenant invoice metadata

HTTP Replay with Stored Identity

Replay

Replay a captured HTTP request inside the same project record used for WebSocket work.

bash
1POST /platform/projects/{project}/attacks/http/replay
2{
3  "identity_id": "support-user",
4  "request_id": "req_42"
5}
6 
7# Output
8# replay_status: complete
9# evidence_record: http_replay_completed

Duplicate Action Race Window

Race

Fire parallel requests against a state-changing workflow to spot replay-before-invalidation windows.

bash
1POST /platform/projects/{project}/attacks/race
2{
3  "waves": 3,
4  "parallelism": 8,
5  "action": "approve_refund"
6}
7 
8# Output
9# suspicious_race_window: true
10# accepted_duplicates: 2

Validation Lab Regression Run

Validation

Use the shipped local labs to check that replay, diff, race, and evidence paths still behave as expected.

bash
1./venv/bin/python validation/run_validation.py
2 
3# Output
4# full_stack_realtime_saas: passed
5# socketio_saas: passed
6# graphql_subscriptions_lab: passed