Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Probe command arguments
Send a DNS-safe host to both diagnostic routes, then add WSHK_CMD_PROBE through a command separator. Never use a destructive operating-system command.
POST /api/diagnostics-insecure
{"host":"127.0.0.1;echo WSHK_CMD_PROBE"}Secure returns 400; insecure returns the WSHK_CMD_PROBE marker.
Probe NoSQL structure
Send a literal username first, then replace the scalar with a $ne object. Preserve application/json so object structure reaches the parser.
POST /api/users-insecure
{"filter":{"$ne":null}}Secure rejects the object; insecure returns multiple users including admin.
Check mutation boundaries
Confirm WSHawk mutates only host or filter. Exclude authorization headers, identity cookies, and unrelated JSON fields from the payload position.
Save separate findings
Command injection and NoSQL injection have different causes and remediation. Keep their requests, markers, severity, and replay instructions separate.
Prove it before moving on.
Both findings reproduce with a harmless marker and include a secure-control comparison.