Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Build a small scan
Select only the family matching the endpoint, one injection point, a request cap below 25, no retries, and one worker. Run the secure route first.
Use Smart Payload Evolution
Enable SPE for one lab route and inspect each derived payload. Keep mutations in the marked value and reject payloads that change authentication, methods, or destinations.
Review scanner signals
Group results by family, endpoint, parameter, normalized behavior, and evidence marker. Consolidate duplicates before triage.
Set confidence and CVSS
Confidence measures proof quality; CVSS measures impact conditions. Record the vector assumptions instead of copying a default score.
Run the full local catalogue
Repeat for sqli, xss, command_injection, nosql_injection, path_traversal, xxe, ssrf, prototype_pollution, and redirect. Save false-positive notes for the secure pairs.
Prove it before moving on.
Your project has one reviewed result per scanner family, bounded payload history, deduplicated evidence, and explained CVSS assumptions.