Foundation · 4–6 weeks
Build the mental model
Scope, traffic, requests, state, identity, capture, replay, and controlled object discovery.
Learn the system.
Prove the behavior.
9 practical programmes, 49 guided lessons, and one controlled lab. Start with setup or jump directly to the workflow you need.
01 / ALL COURSES
Choose your fieldwork.
01Flagship path↗
WSHawk Practitioner
Build a reliable WSHawk workflow from project setup and identity capture through HTTP, GraphQL, and WebSocket replay.
- Capture & replay
- Identity recording
- Object discovery
- Protocol maps
02Core security↗
Authorization by Design
Use matrices, explicit policies, semantic comparison, bounded object mutation, and safe writes to prove authorization failures.
- IDOR / BOLA
- BFLA
- Tenant isolation
- GraphQL
- Safe writes
03Realtime systems↗
WebSocket Fieldwork
Test connection identity, rooms, subscriptions, event replay, and race behavior in stateful realtime systems.
- Handshake auth
- Rooms
- Subscriptions
- Event replay
- Race testing
04Professional practice↗
Evidence That Holds Up
Turn technical behavior into protected, reproducible findings with semantic analysis, lifecycle management, export, and retesting.
- Semantic analysis
- Findings
- Redaction
- Reporting
- Retesting
05Scanner practice↗
Injection & Browser Testing
Exercise every WSHawk injection family against paired secure and vulnerable controls, verify browser execution, and tune scanner confidence.
- SQLi and NoSQLi
- XSS and Playwright
- XXE and SSRF
- Payload evolution
06Web modules↗
Recon & Web Assessment
Use WSHawk's crawler, directory, HTTP, headers, TLS, CORS, CSRF, WAF, sensitive-data, and chaining modules as one scoped workflow.
- Crawl and directory
- Headers, CORS and TLS
- CSRF and WAF
- Attack chains
07Realtime depth↗
WebSocket Engineering
Go beyond room checks into connection controls, interception, scanners, binary protocols, session security, subscriptions, and recovery behavior.
- Handshake controls
- Interceptor and replay
- Binary analysis
- Session abuse
08Operations↗
Projects, Evidence & Integrations
Manage durable projects, browser identities, flows, findings, protected evidence, reports, integrity, external systems, and certificates.
- Project storage
- Browser evidence
- Reports and SARIF
- Integrations and certificates
09Tooling breadth↗
Interfaces & Defensive Validation
Choose the right WSHawk interface and use the defensive validator for egress, automation, and cross-site WebSocket controls.
- CLI and dashboard
- Classic and Go desktop
- Python API and Docker
- Defensive validator
02 / LEARNING PATHS
Move when you can reproduce the result.
Practitioner · 6–10 weeks
Operate with confidence
Authorization matrices, GraphQL, realtime systems, safe mutation, races, and false-positive control.
Professional · Self-paced
Make the work defensible
Protected evidence, lifecycle management, reproducible reporting, and automated retesting.
Scanner specialist · 6-10 weeks
Test every input path
Injection families, browser verification, crawling, discovery, TLS, CORS, CSRF, and controlled attack chains.
Realtime specialist · 4-8 weeks
Research stateful protocols
Handshake controls, interception, payload evolution, binary protocols, subscriptions, sessions, and recovery.
Security operations · 4-6 weeks
Preserve and move the proof
Project durability, browser evidence, protected storage, reporting, integrations, interfaces, and defensive validation.
03 / YOUR PRACTICE TARGET
Open the lab guide ↗Every testable module points to a runnable case.
The downloadable lab pairs secure controls with intentional web, GraphQL, WebSocket, authorization, browser, OAST, and race behaviors. Public DNS, WHOIS, subdomain, port, and TLS lessons explain their separate authorized-target requirements instead of fabricating internet results.