WSHawk v4 Overview

What WSHawk v4.0.4 is, how its two desktop editions differ, and where authorization, replay, evidence, and validation fit.

WSHawk v4 Overview

WSHawk v4.0.4 is an open-source platform for authorized testing of WebSocket applications, stateful HTTP and GraphQL workflows, browser-authenticated sessions, authorization flaws, race conditions, and realtime application evidence.

What Changed in v4

The current release provides a compatibility CLI and two independently packaged desktop applications.

| Edition | Backend | Best fit | |---|---|---| | Classic WSHawk | Electron + Python services | Established project workflows, CLI integration, browser companion, replay, race, evidence, and web pentest tools | | WSHawk Electron + Go | Electron + private Go worker | Bridge-free operation, authorization matrices, bounded object discovery, protected evidence, findings, and retesting |

The important shift is this:

  1. capture real traffic and identity context
  2. store it in a local project
  3. replay or compare stateful actions
  4. race state-changing operations
  5. review evidence and export a bundle

Core Capabilities

  • desktop-first workflows for WebSocket and HTTP targets
  • HTTP, GraphQL, and WebSocket authorization matrices
  • IDOR/BOLA, vertical escalation, missing-authentication, BFLA, admin-only, tenant-isolation, and ownership-transfer policies
  • object discovery in paths, queries, JSON, GraphQL variables, UUIDs, numeric neighbors, and captured traffic
  • safe write testing with dry run, confirmation, evidence, cleanup, and rollback verification
  • WebSocket and HTTP replay
  • AuthZ diff across identities
  • race testing for duplicate execution and invalidation windows
  • browser companion pairing for scoped handshake capture
  • web pentest workspace in the same project model
  • local validation labs for regression proof
  • evidence exports with provenance and integrity metadata
  • encrypted Electron + Go projects, redaction, hash-only evidence, and retention controls
  • findings lifecycle, duplicate consolidation, selected export, and automated retesting

What WSHawk Is Not

WSHawk is not a full-spectrum red-team operating stack. It does not replace C2, endpoint tradecraft, or infrastructure operations. Its lane is offensive web and realtime application security work.

Where to Start