WSHawk v4.0.4

WSHawk 4.0.4 packages the CLI, defensive validator, and desktop security testing application.

Downloads

Platform	Package	Format
Windows	WSHawk Setup 4.0.4.exe	NSIS installer
Linux	wshawk-4.0.4.AppImage	AppImage
Linux	wshawk-4.0.4.deb	Debian/Ubuntu package
Linux	wshawk-4.0.4.pacman	Arch Linux package
macOS	WSHawk-4.0.4-arm64.dmg	DMG installer
Python	wshawk-4.0.4-py3-none-any.whl	Wheel
Python	wshawk-4.0.4.tar.gz	Source distribution

Verify downloads

Download SHA256SUMS.txt and compare the SHA-256 value before installation.

Installation notes

• Windows: run the NSIS .exe installer.
• Linux: use the portable .AppImage, install the .deb on Debian/Ubuntu, or install the .pacman package on Arch Linux.
• macOS: open the .dmg and move WSHawk into Applications.
• Python: install the wheel with python -m pip install <wheel-file>.

Research paper

• Zenodo preprint (10.5281/zenodo.21290858)
• Figshare preprint (10.6084/m9.figshare.32955467.v1)

What's changed

Fixed

• Headless Linux Electron Startup — Test and audit harnesses now provide an ephemeral encrypted-project key when no desktop keyring is available, while production startup continues to fail closed without secure key storage.
• Electron CI Diagnostics — First-window failures now report the Electron process state, standard error, and standard output instead of ending with an unexplained Playwright timeout.
• Dual Desktop Publication — The Electron + Go release pipeline can complete its test gate and publish native Windows, Linux, and macOS packages under electron-go-v4.0.4 alongside the classic v4.0.4 release.

Changed

• Startup Error Handling — Fatal Electron initialization errors are logged and terminate with a non-zero exit status.
• Version Synchronization — Updated Python, both desktop editions, the extension, Docker metadata, citation metadata, validation labs, evidence, and release documentation to 4.0.4.

---

GitHub's contributor and pull-request changelog is appended below.

Full Changelog: v4.0.3...v4.0.4

WSHawk Electron + Go v4.0.4

This is the Electron frontend and private Go-worker edition of WSHawk. The classic desktop release is published separately under the original version tag.

Downloads

Platform	Package	Bytes
Linux	wshawk-electron-go-4.0.4-linux-amd64.deb	340410692
Linux	wshawk-electron-go-4.0.4-linux-x64.tar.gz	405048086
Linux	wshawk-electron-go-4.0.4-linux-x86_64.AppImage	396138177
macOS	wshawk-electron-go-4.0.4-mac-arm64.dmg	392964665
macOS	wshawk-electron-go-4.0.4-mac-arm64.zip	392550395
Windows	wshawk-electron-go-4.0.4-win-x64.exe	329162648

Use the Windows installer, Linux AppImage or DEB, or macOS DMG for the normal installation path. TAR.GZ and ZIP packages are portable alternatives.

Included in this release

• Electron interface connected directly to a private Go worker over IPC
• HTTP, WebSocket, GraphQL and authorization testing workspaces
• Authorization matrices, object-ID mutation, policy-aware findings and retesting
• Encrypted project storage, evidence redaction and integrity hashes
• Bundled Chromium runtime for browser validation and evidence capture
• Local authorization and vulnerability lab for repeatable testing

Validation

• Node and Go unit tests, worker smoke tests and Electron end-to-end tests
• Classic Python versus Go parity checks and authorization benchmarks
• Native Windows, Linux and macOS package verification
• Windows install, upgrade, launch and uninstall lifecycle checks

Integrity verification

Download SHA256SUMS-ELECTRON-GO.txt and compare the SHA-256 value for your package before installation.

Source version: v4.0.4. Electron release tag: electron-go-v4.0.4.

Full Changelog: v4.0.3...electron-go-v4.0.4

WSHawk v4.0.2

WSHawk 4.0.2 packages the CLI, defensive validator, and desktop security testing application.

Downloads

Platform	Package	Format
Windows	WSHawk Setup 4.0.2.exe	NSIS installer
Linux	wshawk-4.0.2.AppImage	AppImage
Linux	wshawk-4.0.2.deb	Debian/Ubuntu package
Linux	wshawk-4.0.2.pacman	Arch Linux package
macOS	WSHawk-4.0.2-arm64.dmg	DMG installer
Python	wshawk-4.0.2-py3-none-any.whl	Wheel
Python	wshawk-4.0.2.tar.gz	Source distribution

Verify downloads

Download SHA256SUMS.txt and compare the SHA-256 value before installation.

Installation notes

• Windows: run the NSIS .exe installer.
• Linux: use the portable .AppImage, install the .deb on Debian/Ubuntu, or install the .pacman package on Arch Linux.
• macOS: open the .dmg and move WSHawk into Applications.
• Python: install the wheel with python -m pip install <wheel-file>.

Research paper

• Zenodo preprint (10.5281/zenodo.21290858)
• Figshare preprint (10.6084/m9.figshare.32955467.v1)

What's changed

Added

• DOM Invader Decomposition — Split the monolithic dom_invader.py into focused modules: dom_auth.py (auth flow recording/replay), dom_browser.py (browser pool management), dom_xss.py (XSS verification engine), dom_models.py (data models), and dom_runtime.py (runtime coordination).
• Scanner Attack Engine (scanner_attacks.py) — Extracted attack orchestration from scanner_v2.py into a dedicated module with structured error types (scanner_errors.py).
• Legacy Runtime Extraction (legacy_runtime.py) — Extracted 982-line runtime logic from legacy_core.py to reduce module size from 1200+ lines.
• Binary Mutations Module (binary_mutations.py) — Dedicated binary protocol mutation engine separated from binary_handler.py.
• Project Correlation Engine (store/project_correlation.py) — Cross-project vulnerability correlation and trending analysis.
• WAF Signature Database (waf/signatures.py) — Externalized WAF detection signatures from inline detector logic.
• Payload Catalog (payload_catalog.py) — Centralized payload registry replacing scattered payload references.
• TLS Utilities (tls.py) — Shared TLS/SSL helper for certificate and cipher validation.
• Daemon Route Decomposition — Split massive route files into focused modules: platform_route_support.py, web_route_support.py, web_workflow_routes.py, session_routes.py, and errors.py.
• CLI Overhaul — New cli.py and console.py modules providing unified entry points and UTF-8-safe console output.
• Database Row Models (database_rows.py) — Typed row models for the SQLite project store.
• Benchmark Suite — New benchmarks/ framework with desktop_security_lab, industry_lab, and run.py harness for reproducible security validation.
• Validation Benchmarks — Added web_attack_benchmark and websocket_attack_benchmark scenarios with deterministic apps and scoring.
• Release Scripts — release_desktop_artifacts.py, verify_pyinstaller_hiddenimports.py, and verify_wheel_contents.py for release-gate automation.

Security

• Secret Storage — Fixed Windows DPAPI initialization and made configured secure backends fail closed instead of silently falling back to plaintext.
• Local Services — Defaulted the legacy dashboard to loopback, required authentication for remote binds, added CSRF/throttling/security headers, and blocked remote requests to private scan targets.
• Extension Pairing — Added short-lived, desktop-approved first-time pairing and origin-bound extension sessions.
• Renderer Hardening — Removed unsafe dynamic HTML rendering paths and added regression checks for desktop and extension JavaScript.
• Validation Artifact Redaction — Redacted authentication and session material at the validation persistence boundary, including secret copies embedded in messages and URL query parameters.
• Dependency Auditing — Added Python advisory auditing to the release-security gate alongside the existing production and complete npm audits.
• Bridge Security — Hardened bridge authentication and CSRF protections in bridge_security.py.
• Sandbox Enforcement — Desktop smoke tests now always disable sandbox in CI to prevent SIGTRAP crashes, while production builds retain full sandbox enforcement.
• Path Validation — Added tempfile.gettempdir() to allowed roots in fuzzer.py and dir_scanner.py for safe temporary file access during test execution.

Changed

• Compatibility Baseline — Declared Python 3.10–3.13 and moved optional browser and analysis dependencies into extras.
• Release Gates — Added cross-platform Python/desktop jobs, installed CLI and Electron smoke tests, dependency audits, Ruff, targeted mypy, wheel inspection, and release-security checks.
• Packaging — Made pyproject.toml and wshawk/_version_info.py authoritative, excluded repository-only files from wheels, and consolidated container publishing.
• Research Publication — Added the WSHawk preprint records from Zenodo and Figshare to the project README and generated release notes.
• GitHub Releases — Platform installers now appear as clearly named Actions artifacts and are attached to tagged releases with SHA-256 manifests, installation guidance, categorized changes, and direct download links.
• Desktop Electron Hardening — Rewrote headless CI switches: removed crash-inducing --single-process and --in-process-gpu, added --headless=new, --no-zygote, --disable-gpu-sandbox, platform-guarded --ozone-platform to Linux only.
• Defensive Validation Expansion — Extended defensive_validation.py with 400+ lines of new validation logic including enhanced CSWSH, DNS exfiltration, and origin threshold testing.
• WSS Security Validator — Expanded TLS/cipher/certificate validation with 240+ lines of additional checks.
• Advanced CLI — Refactored advanced_cli.py and legacy_advanced_cli.py with improved argument handling and interactive mode.
• Scanner v2 Slimming — Reduced scanner_v2.py by 596 lines by extracting attack orchestration to scanner_attacks.py.
• DOM Invader Slimming — Reduced dom_invader.py by 793 lines by decomposing into focused sub-modules.
• Legacy Core Slimming — Reduced legacy_core.py by 1221 lines by extracting runtime logic.
• Web Routes Slimming — Reduced daemon/web_routes.py by 617 lines by extracting workflow and support modules.
• Platform Routes Slimming — Reduced daemon/platform_routes.py by 387 lines into platform_route_support.py.
• Secret Store — Refactored with 120 lines of improved platform-specific secure storage backends.
• Session Hijacking Tester — Hardened with additional auth flow and token validation checks.
• Smart Payloads — Improved context_generator.py, feedback_loop.py, and payload_evolver.py with better error handling and adaptive tuning.
• Web Pentest Modules — Hardened ssrf_prober.py, waf_detector.py, tech_fingerprint.py, cors_tester.py, redirect_scanner.py, and header_analyzer.py with stricter validation and error handling.
• Integration Connectors — Improved error handling in defectdojo.py, jira_connector.py, and webhook.py.
• GUI Bridge — Enhanced Python sidecar with 82 lines of improved bridge communication and error recovery.

Fixed

• Desktop Sidecar Packaging — Removed stale PyInstaller hidden imports and added a pre-build verifier that fails when declared runtime modules are unavailable.
• Container Build Context — Excluded desktop dependencies and other repository-only inputs from Docker build contexts.
• CLI Reliability — Unified all installed command versions and bounded defensive DNS/origin probing behavior for unavailable targets.
• Desktop CI Smoke Crash (Linux) — SIGTRAP caused by --single-process forcing renderer/GPU into main process. Removed.
• Desktop CI Smoke Crash (macOS arm64) — SIGTRAP caused by unstable --single-process on ARM and --ozone-platform=headless (Linux-only flag). Fixed.
• Desktop CI Smoke Crash (Windows) — ContextResult::kFatalFailure caused by --in-process-gpu conflicting with --disable-gpu. Removed.
• Wordlist Empty Error — ValueError in fuzzer/scanner tests when temp directories were outside hardcoded allowed_roots.
• Legacy Web Security — Fixed rendering and authentication paths in web/legacy_app.py templates.

Removed

• ssrf_test.py — Removed obsolete standalone SSRF test module (functionality consolidated into web_pentest/ssrf_prober.py).

Tests

• Added 18 new test modules: test_benchmark_harness, test_bridge_security, test_cli_entrypoints, test_cli_scan_reliability, test_daemon_errors, test_daemon_state, test_defensive_dns_callback, test_desktop_security, test_desktop_security_lab, test_legacy_web_security, test_memory_bounds, test_module_boundaries, test_optional_dependencies, test_pyinstaller_spec, test_release_desktop_artifacts, test_security_attack_benchmark_labs, test_web_attack_regressions, test_http_attack_services.
• Expand...

WSHawk v4.0.1

WSHawk v4.0.1

WSHawk v4.0.1 is a bug-fix release focused on desktop workflow clarity and web testing reliability.

---

Fixes

• Fixed web crawler event binding so crawl results no longer disappear on late bridge connection
• Surfaced crawler transport errors instead of failing silently
• Normalized bare host and IP targets in web tooling
• Suppressed SPA soft-404 noise in Dir Scanner
• Grouped near-identical variant hits such as /api, /api.php, /api.js, and similar paths
• Corrected Dir Scanner rendering and grouped-result summaries
• Clarified WS Forge vs HTTP Forge labels in the desktop UI

---

Notes

• No breaking changes
• Existing projects remain compatible
• This release is focused on bug fixes and workflow quality improvements

WSHawk v4.0.0

WSHawk v4.0.0

WSHawk v4 introduces a major architectural shift from a standalone WebSocket scanner to a project-backed offensive security platform designed for modern web and realtime application testing.

---

Key Highlights

Project-Based Workflow

• Unified project model for WebSocket and HTTP testing
• Centralized storage of identities, traffic, findings, and evidence
• Structured workflows for replay, comparison, and validation

Replay, Authorization Diffing, and Race Testing

• Identity-aware replay across sessions
• Cross-role and cross-tenant behavior comparison
• Stateful race condition testing for critical actions

Desktop Application

• Electron and Python hybrid architecture
• WebSocket interceptor with frame-level control
• Payload Blaster for high-throughput testing
• Endpoint mapping and authentication workflow tools

Web Penetration Testing Toolkit

• Crawler, fuzzer, and directory scanner
• SSRF, CORS, redirect, and prototype pollution testing
• TLS, headers, and sensitive data analysis

Evidence and Reporting

• Project-backed evidence timeline
• Tamper-evident export bundles
• Export formats: HTML, JSON, Markdown, PDF, CSV, SARIF

Validation Labs

• Full-stack realtime SaaS testing scenarios
• Socket.IO workflow validation
• GraphQL subscription testing

Smart Payload Engine

• Context-aware payload generation
• Adaptive mutation based on target responses

Browser-Assisted Testing

• Playwright integration for XSS validation
• Browser companion for handshake and session capture

---

Breaking Changes

• The CLI is now a compatibility layer for legacy workflows
• Core functionality is centered around the project-backed platform and desktop interface

---

Downloads

Platform	File
Windows	.exe
macOS	.dmg
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

---

Installation

pip install wshawk==v4.0.0

---

Full Changelog

v3.0.5...v4.0.0

---

WSHawk is intended for authorized security testing, research, and education. Ensure proper authorization before use.

WSHawk v3.0.6

WSHawk v3.0.6

Enterprise-grade WebSocket security scanner with web penetration testing toolkit.

Downloads

Platform	File
Windows	.exe (NSIS installer)
macOS	.dmg (Apple Disk Image)
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

Install via pip

pip install wshawk==v3.0.6

Full Changelog: v3.0.5...v3.0.6

WSHawk v3.0.5

WSHawk v3.0.5

Enterprise-grade WebSocket security scanner with web penetration testing toolkit.

Downloads

Platform	File
Windows	.exe (NSIS installer)
macOS	.dmg (Apple Disk Image)
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

Install via pip

pip install wshawk==3.0.1

Full Changelog: v3.0.0...v3.0.5

WSHawk v3.0.4

WSHawk v3.0.4

Enterprise-grade WebSocket security scanner with web penetration testing toolkit.

Downloads

Platform	File
Windows	.exe (NSIS installer)
macOS	.dmg (Apple Disk Image)
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

Install via pip

pip install wshawk==3.0.1

Full Changelog: v3.0.0...v3.0.4

WSHawk v3.0.3

WSHawk v3.0.3

Enterprise-grade WebSocket security scanner with web penetration testing toolkit.

Downloads

Platform	File
Windows	.exe (NSIS installer)
macOS	.dmg (Apple Disk Image)
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

Install via pip

pip install wshawk==3.0.1

Full Changelog: v3.0.0...v3.0.3

WSHawk v3.0.2

WSHawk v3.0.2

Enterprise-grade WebSocket security scanner with web penetration testing toolkit.

Downloads

Platform	File
Windows	.exe (NSIS installer)
macOS	.dmg (Apple Disk Image)
Linux (Universal)	.AppImage
Arch Linux	.pacman
Ubuntu/Debian	.deb

Install via pip

pip install wshawk==3.0.1

Full Changelog: v3.0.0...v3.0.2