Getting Started with WSHawk v4

Pick Classic Electron + Python, Electron + Go, or the CLI, then start with the correct v4.0.4 validation lab.

Getting Started with WSHawk v4

The shortest practical rule is simple:

  • use the CLI for a fast first pass
  • use Classic Electron + Python for the established project and web pentest workflow
  • use Electron + Go for bridge-free authorization, protected evidence, findings, and retesting
  • use the validation labs before testing a real target

CLI Quick Start

pip install wshawk
playwright install chromium
wshawk ws://target.example/ws

The CLI is still useful, but it is no longer the whole story.

Download a Desktop

Desktop from Source

Classic Electron + Python:

git clone https://github.com/regaan/wshawk
cd wshawk
pip install -e .
cd desktop
npm install
npm run smoke
npm start

Electron + Go:

cd electron-desktop
npm ci
npm run build:go
npm start

Run the Validation Labs

./venv/bin/python validation/run_validation.py --list
./venv/bin/python validation/run_validation.py

The v4.0.4 labs cover:

  • full-stack realtime SaaS
  • Socket.IO SaaS
  • GraphQL subscriptions
  • secure and deliberately vulnerable HTTP, GraphQL, and WebSocket authorization cases
  • a scored 34-scenario Electron + Go authorization benchmark

First Useful Workflow

  1. open or create a desktop project
  2. connect a target or lab
  3. pair the browser companion if browser auth matters
  4. capture traffic
  5. replay a real action
  6. compare behavior across identities
  7. run a race if the action changes state
  8. review evidence and export

For the authorization workspace, begin with a dry run, verify the matrix identities and object candidates, then execute only the bounded campaign you intend to test.