Publications and research notes by Regaan R.https://regaan.dev/https://regaan.dev/publications/wshawk/https://regaan.dev/publications/wshawk/Most automated web-application scanners are built around the request/response model of HTTP and do not translate cleanly to WebSocket endpoints, where a single long-lived, bidirectional connection carries application state and where server reactions may arrive asynchronously and out of band. This paper presents an implementation study of WSHawk, an open-source toolkit (v4.0.1, AGPL-3.0) for authorized security assessment of WebSocket and related realtime web applications. Working strictly from the source code, this study describes how WSHawk keeps connections open across a learning phase and per-vulnerability probing phases; how a two-layer payload subsystem—a strategy-scored mutation engine and a genetic “Smart Payload Evolution” pipeline (context-aware generator, response-classifying feedback loop, and crossover/mutation evolver)—adapts attack strings to observed server behaviour; how a Playwright-backed browser pool converts heuristic cross-site scripting (XSS) findings into sandboxed execution evidence and records/replays single sign-on flows; and how out-of-band callbacks detect blind XML External Entity (XXE) and Server-Side Request Forgery (SSRF). This paper further documents a project-backed store and a set of parallel HTTP and WebSocket attack services (replay, authorization diffing, race testing, subscription abuse) unified by a variable-templating workflow engine with six built-in playbooks; a protocol-graph subsystem that fingerprints six realtime protocol families (GraphQL-WS, Phoenix Channels, ActionCable, SignalR, Socket.IO, and a generic/binary fallback) and recommends attacks; a binary-message handler with format auto-detection and mutation; a WebSocket endpoint-discovery module; a session-hijacking tester and a blue-team defensive-validation suite (DNS exfiltration, bot detection, CSWSH, and WSS/TLS posture); an Ed25519-signed, hash-chained evidence bundle with redaction; a process-isolated plugin system; an adaptive token-bucket rate limiter and an HTTP resilience layer with retry and circuit breaking; and integrations for Jira, DefectDojo, and webhooks. The current repository focuses on engineering validation through a unit/integration test suite and three local realtime-application validation labs; a comprehensive empirical evaluation of detection accuracy against a benchmark corpus remains future work.Thu, 09 Jul 2026 00:00:00 GMThttps://regaan.dev/publications/basilisk/https://regaan.dev/publications/basilisk/Basilisk is an open-source artificial intelligence (AI) red teaming and large language model (LLM) penetration testing framework. It maps the adversarial attack surface of LLM applications to the OWASP LLM Top 10 threat model and couples this coverage with an evolutionary prompt search engine called Smart Prompt Evolution for Natural Language (SPE-NL). Designed for security researchers, penetration testers, and offensive security teams, Basilisk automates the discovery of security boundaries, refusal triggers, instruction overrides, and data leakage vectors. It runs differential scans across multiple hosted and local models, grades guardrail postures, and maintains digital signature validation on its execution logs and native shared libraries.Sun, 08 Mar 2026 00:00:00 GMThttps://regaan.dev/blog/ast-sql-waf-bypass/https://regaan.dev/blog/ast-sql-waf-bypass/Analyzing the failure of Abstract Syntax Tree (AST) tokenization filters when confronted with context-aware, deterministic syntax mutations.Sun, 15 Feb 2026 00:00:00 GMThttps://regaan.dev/blog/websocket-threat-analysis/https://regaan.dev/blog/websocket-threat-analysis/Uncovering race condition patterns and blind server hijackings in active full-duplex WebSocket channels.Tue, 20 Jan 2026 00:00:00 GMThttps://regaan.dev/blog/llm-genetic-prompt-mutations/https://regaan.dev/blog/llm-genetic-prompt-mutations/Applying genetic algorithms to automate safety evaluation vectors against boundaries in Large Language Models.Wed, 10 Dec 2025 00:00:00 GMT