Electron + Go Desktop

WSHawk v4.0.4 includes a separately packaged Electron desktop backed by a private Go worker. It does not replace the Classic Electron + Python edition.

Download

Electron + Go packages include a Windows NSIS installer, Linux AppImage, DEB and archive formats, and macOS DMG and ZIP formats. Verify downloads with SHA256SUMS-ELECTRON-GO.txt from the same release.

Architecture

Sandboxed renderer
    -> allowlisted Electron IPC
Electron main process
    -> versioned JSON-RPC over private stdin/stdout
Go worker
    -> encrypted projects, HTTP and WebSocket transports,
       scanners, authorization policies, findings, and reports

Electron main process
    -> isolated Playwright contexts for auth and browser evidence

The Go worker does not expose a localhost HTTP or Socket.IO bridge. Node integration remains disabled in the renderer, and IPC requests are validated against a versioned allowlist.

Project Records

Projects can store:

targets, notes, identities, and sessions;
HTTP flows and WebSocket frames;
protocol maps and timelines;
findings and reproducible evidence.

Sensitive project content is encrypted with AES-256-GCM. The operating system protects the project key.

Workspaces

Standard covers projects, targets, WebSocket capture, sessions, protocol maps, timelines, notes, and reports.

Advanced covers interception, replay, WS Forge, payload mutation, DOM Invader, Playwright auth recording, authorization tests, and findings.

Web covers HTTP Forge, crawling, directory discovery, vulnerability scanning, fuzzing, headers, CORS, WAF, TLS, SSRF, redirects, CSRF, prototype pollution, and sensitive-data checks.

Build and Validate

git clone https://github.com/regaan/wshawk
cd wshawk/electron-desktop
npm ci
npm run build:go
npm start

npm run test:all
npm run test:parity
npm run test:e2e
npm run test:authorization-benchmark

Run only the package command for the current host: npm run dist:win, npm run dist:linux, or npm run dist:mac.