Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Probe object merging
Send the constructor/prototype marker to the secure and insecure settings routes. Do not add application-changing properties.
POST /api/settings-insecure
{"constructor":{"prototype":{"wshawk_probe":true}}}Secure 400; insecure reports polluted true.
Probe external navigation
Disable automatic redirect following and use wshawk.invalid as the non-resolving destination.
GET /redirect-insecure?next=https%3A%2F%2Fwshawk.invalidSecure 400; insecure 302 with an external Location header.
Check browser impact
For redirects, record the response Location rather than browsing to it. For prototype pollution, confirm a downstream effect before assigning high severity on a real application.
Preserve control evidence
Save both secure and insecure responses so reviewers can distinguish intended routing from arbitrary external redirects and safe copies from unsafe deep merges.
Prove it before moving on.
Both results use inert markers and contain clear secure-control evidence.