Quick Start

Comprehensive CLI Reference

WSHawk provides four separate CLI entry points for different operational modes.

1. wshawk (Standard Scanner)

The standard CLI initiates the heuristic vulnerability scanner against a target WebSocket URI.

Syntax: wshawk [OPTIONS] <TARGET_URI>

Key Parameters:

• --headers <JSON>: Pass custom HTTP headers (e.g., {"Authorization": "Bearer token"}).
• --timeout <INT>: Timeout for socket connections (default: 10).
• --concurrency <INT>: Number of concurrent async payload tasks (default: 50).
• --format <STRING>: Output format (json, html, csv, sarif).
• --out <FILE>: Output file path.

Example:

wshawk wss://api.target.com/chat --headers '{"Cookie": "session=xyz"}' --format sarif --out results.sarif

2. wshawk-advanced (Deep Auditing)

The advanced CLI enables computationally expensive features like the Smart Payload Engine and Headless Verifier.

Syntax: wshawk-advanced [OPTIONS] <TARGET_URI>

Key Parameters:

• --smart-payloads: Enables the genetic algorithm payload evolver.
• --playwright: Enables the headless Chromium XSS verifier.
• --oast: Enables Out-Of-Band (OAST) callback detection for blind SSRF.
• --generations <INT>: Number of evolution generations to process (default: 10).
• --population <INT>: Size of the payload population pool (default: 50).
• --full: Enables all advanced checks simultaneously.

Example:

wshawk-advanced wss://api.target.com/data --smart-payloads --playwright --oast

3. wshawk-interactive (REPL Mode)

Starts a Read-Eval-Print Loop (REPL) for manual, frame-by-frame interaction with a WebSocket endpoint without utilizing the Electron GUI.

Example Session:

$ wshawk-interactive
> connect wss://target.com/ws
[+] Connected to wss://target.com/ws
> send {"action": "ping"}
[<] {"status": "pong", "timestamp": 1690000000}
> fuzz {"action": "view_user", "id": §FUZZ§} --type sqli
[!] Fuzzing initiated. Check wshawk.log for results.

4. wshawk-defensive (Blue Team Validation)

Designed for defensive engineering teams to validate the effectiveness of their security controls.

Key Parameters:

• --test-cswsh: Tests origin header validation.
• --test-tls: Validates cipher suites and TLS protocol versions.
• --test-bot-evasion: Simulates headless browser bot traffic to test WAF bot-protection mechanisms.

---