Threat Model

Threat Model & Scope Definitions

WSHawk operates under a strictly defined threat model. It is designed to evaluate specific Web Application and API vulnerabilities within the application layer (OSI Layer 7).

Assumptions

• Authorization: The operator executing WSHawk possesses explicit, documented authorization to perform penetration testing against the target infrastructure.
• Network Reachability: The host running WSHawk can establish a TCP connection to the target server and successfully negotiate the HTTP Connection: Upgrade handshake.
• Protocol Support: The target application relies on standard HTTP or WebSocket protocols.

In Scope (Supported Attack Vectors)

• Cross-Site WebSocket Hijacking (CSWSH): Bypassing Origin, CORS, and CSRF token restrictions during the initial HTTP handshake phase.
• DOM-based & Reflected XSS: Exploiting unsafe client-side rendering (e.g., innerHTML) of data pushed via WebSocket frames.
• Blind SSRF & OAST: Triggering out-of-band network calls from backend workers processing message queues fed by WebSocket data.
• SQL & NoSQL Injection: Exploiting backend database queries triggered by specific JSON properties within the WebSocket payload envelope.
• Command Injection: Exploiting blind execution contexts using time-based payloads (e.g., sleep 10) or asynchronous callback markers.
• Vertical & Horizontal Privilege Escalation (IDOR/BOLA): Tested via Identity-Aware Replay of WebSocket state sequences.

Out of Scope (Unsupported / Prevented Vectors)

• Layer 3 / Layer 4 DDoS Attacks: WSHawk does not perform SYN floods, UDP amplification, or volumetric bandwidth exhaustion attacks. (Note: Highly aggressive fuzzing may inadvertently cause application-level DoS).
• Supply-Chain Dependency Exploits: WSHawk does not scan the target’s node_modules or Python dependencies for known CVEs.
• Physical Security Penetration: Beyond the scope of network assessment.
• Social Engineering / Phishing: WSHawk does not generate phishing templates or credential harvesting infrastructure.
• Zero-Click OS Exploitation: WSHawk focuses on application-layer logic flaws, not binary buffer overflows or kernel exploitation.

---