Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Send a normal search
In HTTP Forge set POST, JSON content type, and send the same ordinary term to both routes. Save both 200 responses as the baseline.
POST /api/search-secure
{"term":"academy"}Both controls return one harmless result.
Run the secure probe
Replace only term with the scanner quote/boolean probe. Keep redirects, retries, and concurrency disabled.
POST /api/search-secure
{"term":"' OR '1'='1"}400 invalid_search from the parameterized control.
Run the vulnerable pair
Send the identical body to search-insecure. Record the SQL-state marker and any leaked row, then compare it with the secure response.
POST /api/search-insecure
{"term":"' OR '1'='1"}500 database_error with SQL syntax evidence.
Confirm without guessing
Use one true and one false boolean variation. Raise confidence only when response semantics change consistently; do not classify a single generic 500 as SQL injection.
Prove it before moving on.
Your evidence contains a normal baseline, secure rejection, true/false behavior, sanitized bodies, and response hashes.