Quick Start

Start with a target you own or a local WSHawk lab.

Standard WebSocket Scan

wshawk ws://127.0.0.1:8765

The standard command accepts a ws:// or wss:// target. Launch the local web management dashboard with:

wshawk --web --host 127.0.0.1 --port 5000

Advanced Scan

Enable adaptive payloads and browser-assisted evidence:

wshawk-advanced ws://127.0.0.1:8765 --smart-payloads --playwright

Enable the complete advanced feature set and write a JSON report:

wshawk-advanced ws://127.0.0.1:8765 --full --format json --output report.json

OAST is enabled by the advanced runtime when configured. Use --no-oast when a controlled callback provider is unavailable.

Interactive and Defensive Modes

wshawk-interactive
wshawk-defensive ws://127.0.0.1:8765

Interactive mode supports manual frame workflows. Defensive mode validates controls such as Origin handling, secure WebSocket posture, DNS-exfiltration resistance, and bot protections.

Local Regression Lab

From a source checkout:

python -m benchmarks.run --iterations 3 --warmup 1

This benchmark starts synthetic localhost targets and checks known vulnerable and hardened behaviors. It is the safest place to learn the modules before testing an authorized application.