Preprint

WSHawk: Stateful Security Assessment of WebSocket Applications through Adaptive Payload Mutation and Browser-Assisted Validation

Regaan R
ROT Independent Security Research Lab

  • WebSocket security
  • stateful scanning
  • payload mutation
  • genetic algorithms
  • browser-assisted validation
  • out-of-band testing
  • protocol inference
  • race conditions
  • authorization testing
  • CVSS
  • tamper-evident evidence
  • penetration testing
July 2026
Published
4.0.1
Version
10.6084/m9.figshare.32955467.v1
DOI
ROT Independent Security Research Lab
Publisher
Download PDF ↗View on Zenodo ↗View on Figshare ↗View Source ↗Project Docs →

Abstract

Most automated web-application scanners are built around the request/response model of HTTP and do not translate cleanly to WebSocket endpoints, where a single long-lived, bidirectional connection carries application state and where server reactions may arrive asynchronously and out of band. This paper presents an implementation study of WSHawk, an open-source toolkit (v4.0.1, AGPL-3.0) for authorized security assessment of WebSocket and related realtime web applications. Working strictly from the source code, this study describes how WSHawk keeps connections open across a learning phase and per-vulnerability probing phases; how a two-layer payload subsystem—a strategy-scored mutation engine and a genetic “Smart Payload Evolution” pipeline (context-aware generator, response-classifying feedback loop, and crossover/mutation evolver)—adapts attack strings to observed server behaviour; how a Playwright-backed browser pool converts heuristic cross-site scripting (XSS) findings into sandboxed execution evidence and records/replays single sign-on flows; and how out-of-band callbacks detect blind XML External Entity (XXE) and Server-Side Request Forgery (SSRF). This paper further documents a project-backed store and a set of parallel HTTP and WebSocket attack services (replay, authorization diffing, race testing, subscription abuse) unified by a variable-templating workflow engine with six built-in playbooks; a protocol-graph subsystem that fingerprints six realtime protocol families (GraphQL-WS, Phoenix Channels, ActionCable, SignalR, Socket.IO, and a generic/binary fallback) and recommends attacks; a binary-message handler with format auto-detection and mutation; a WebSocket endpoint-discovery module; a session-hijacking tester and a blue-team defensive-validation suite (DNS exfiltration, bot detection, CSWSH, and WSS/TLS posture); an Ed25519-signed, hash-chained evidence bundle with redaction; a process-isolated plugin system; an adaptive token-bucket rate limiter and an HTTP resilience layer with retry and circuit breaking; and integrations for Jira, DefectDojo, and webhooks. The current repository focuses on engineering validation through a unit/integration test suite and three local realtime-application validation labs; a comprehensive empirical evaluation of detection accuracy against a benchmark corpus remains future work.

Citations

APA

Regaan R. (2026). WSHawk: Stateful Security Assessment of WebSocket Applications through Adaptive Payload Mutation and Browser-Assisted Validation (Version 4.0.1). ROT Independent Security Research Lab. https://doi.org/10.6084/m9.figshare.32955467.v1

IEEE

Regaan R, "WSHawk: Stateful Security Assessment of WebSocket Applications through Adaptive Payload Mutation and Browser-Assisted Validation," ROT Independent Security Research Lab, 2026. doi: 10.6084/m9.figshare.32955467.v1.

BibTeX

@article{regaan2026,
author = "regaan r",
title = "{WSHawk: Stateful Security Assessment of WebSocket Applications through Adaptive Payload Mutation and Browser-Assisted Validation}",
year = "2026",
month = "7",
url = "https://figshare.com/articles/preprint/WSHawk_Stateful_Security_Assessment_of_WebSocket_Applications_through_Adaptive_Payload_Mutation_and_Browser-Assisted_Validation/32955467",
doi = "10.6084/m9.figshare.32955467.v1"
}