Use only the course lab on 127.0.0.1:8765. Do not copy these tests to a public system without explicit written authorization.
Run the vulnerable control
The private-target and insecure-HTTP flags are required because this course intentionally targets loopback over HTTP. Keep quick mode, one module, no evolution, skipped recon, and isolated-environment enabled.
basilisk scan \
+ --target http://127.0.0.1:8765/vulnerable/v1/chat/completions \
+ --provider custom \
+ --model ground-truth-v1 \
+ --mode quick \
+ --execution-mode validate \
+ --no-evolve --skip-recon --isolated-environment \
+ --allow-private-targets --allow-insecure-http \
+ --module injection.direct --output jsonThe run completes with evidence for the deliberately vulnerable direct-injection behavior.
Repeat against the secure control
Change only /vulnerable/ to /secure/. Keeping every other parameter fixed makes target behavior the independent variable.
The secure endpoint resists the same probe or produces materially different evidence.
Review evidence, not labels
Compare request, response, assertion, severity, confidence, timing, and the ground-truth expectation. A tool result is not confirmed until its evidence supports the conclusion.
Stop the lab
After the exercise, stop the Compose project and verify port 8765 is no longer listening.
docker compose downProve it before moving on.
You have one vulnerable result, one secure control result, and a written explanation based on response evidence.