Evidence and Exports
Project evidence, Electron + Go encryption, redaction, hash-only storage, reproducible requests, exports, and retesting.
Evidence and Exports
Evidence is one of the most important parts of the v4 release.
What Stays in the Project
A project can hold:
- traffic records
- identities
- notes
- findings
- attack runs
- browser artifacts
- timeline events
- export bundles
Browser Evidence
WSHawk can collect Playwright-assisted browser evidence for payload execution signals. The correct framing is evidence collection that supports review, not a blanket promise of perfect automated truth.
Export Bundles
Current export bundles are designed to carry more than a screenshot or a text note. The important pieces are:
- provenance
- related traffic context
- notes and findings
- integrity metadata
Electron + Go Evidence Protection
Electron + Go projects encrypt sensitive content with AES-256-GCM and protect the project key through the operating system. Evidence can apply automatic secret redaction, retention limits, and hash-only body storage. Reveal and copy operations stay explicit.
Authorization findings can include sanitized requests, replay instructions, identity expiration state, timestamps, WSHawk version, a target fingerprint, response hashes, an optional screenshot, and a sanitized cURL reproduction.
Findings and Retesting
The Findings workspace supports lifecycle state, severity, confidence, duplicate consolidation, evidence preview, selected exports, and stable-ID retesting. Retest outcomes are still vulnerable, fixed, authentication expired, endpoint changed, or inconclusive.
Best Practice
Export after the replay, AuthZ diff, or race result has been reviewed and tied back to the relevant traffic and identity context.