You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Fixed fatal XSS scanner crash: WSPayloads.get_xss_payloads() → get_xss()
- Fixed CLI banner showing V3.0.2 instead of current version
- Synchronized version to 3.0.5 across all files:
pyproject.toml, desktop/package.json, wshawk/__init__.py,
wshawk-bridge.spec, PKGBUILD, CITATION.cff, homebrew cask,
debian/changelog, README.md, and CHANGELOG.md
Copy file name to clipboardExpand all lines: CHANGELOG.md
+9Lines changed: 9 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,14 @@
1
1
All notable changes to WSHawk will be documented in this file.
2
2
3
+
## [3.0.5] - 2026-03-23
4
+
5
+
### Fixed
6
+
-**XSS Scanner Module Crash** — Fixed `AttributeError: type object 'WSPayloads' has no attribute 'get_xss_payloads'` in `scanner_v2.py` that caused a fatal abort during the XSS testing phase. The correct method `get_xss()` is now called.
7
+
-**CLI Banner Version Drift** — Banner previously displayed `V3.0.2` regardless of actual version; now correctly shows `V3.0.5`.
8
+
9
+
### Changed
10
+
-**Version Synchronization** — Unified version to `3.0.5` across all project surfaces: `pyproject.toml`, `desktop/package.json`, `wshawk/__init__.py`, `wshawk-bridge.spec`, `PKGBUILD`, `CITATION.cff`, `homebrew-tap/Casks/wshawk.rb`, `debian/changelog`, CLI banner, and README.
LABEL org.opencontainers.image.description="Professional WebSocket security scanner with real vulnerability verification, defensive validation, and CVSS scoring"
**WSHawk** is an enterprise-grade, open-source WebSocket security scanner built for professional penetration testers and red teams. It performs automated vulnerability assessment over WebSocket connections using an adaptive **Smart Payload Evolution (SPE)** engine with real-time feedback loops and genetic payload mutation. Designed for high-performance environments at the **ROT Independent Security Research Lab**.
12
12
13
-
Starting with v3.0.4, we've transitioned to the **AGPL-3.0 license** to better protect the project while keeping it open for the community. This release includes the **Headless DOM Invader** powered by Playwright for real browser-based XSS verification and complex SSO auth flow recording/replay. Also includes a **Context-Aware Heuristic Engine** and **WSHawk Browser Companion** for seamless handshake interception.
13
+
Starting with v3.0.5, we've transitioned to the **AGPL-3.0 license** to better protect the project while keeping it open for the community. This release includes the **Headless DOM Invader** powered by Playwright for real browser-based XSS verification and complex SSO auth flow recording/replay. Also includes a **Context-Aware Heuristic Engine** and **WSHawk Browser Companion** for seamless handshake interception.
**WSHawk v3.0.4** — Professional WebSocket Security Scanner & Interception Suite
378
+
**WSHawk v3.0.5** — Professional WebSocket Security Scanner & Interception Suite
379
379
380
380
---
381
381
382
-
### Latest Updates (v3.0.3)
382
+
### Latest Updates (v3.0.5)
383
383
- **DOM Invader**: Headless Playwright engine verifies XSS payloads in a real browser — zero false positives. Confirms `alert()`, `eval()`, DOM mutations, and injected script tags.
384
384
- **Auth Flow Recorder**: Records complex SSO/OAuth login flows in a visible browser, then replays them headlessly to mint fresh tokens during long fuzzing runs.
385
385
- **Auto Session Reconnect**: Payload Blaster detects session expiry and automatically replays the recorded auth flow to reconnect — no manual intervention needed.
0 commit comments