Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Test the file boundary
Start with welcome.txt, then use the documented traversal marker. The lab returns simulated passwd content; it never reads the host filesystem.
GET /files-insecure?name=..%2F..%2F..%2F..%2Fetc%2FpasswdSecure returns 400; insecure returns the synthetic root:x marker.
Send a safe XML entity
Use the local callback URL in the entity declaration. Keep the entity small and never reference a cloud metadata service or real file.
POST /xml-insecure
<!DOCTYPE x [<!ENTITY p SYSTEM "http://127.0.0.1:5177/oast/callback/xxe">]><x>&p;</x>Secure rejects DOCTYPE; insecure exposes a parser/OAST signal.
Review local OAST
Open /oast/interactions and confirm source xxe. The lab records the intention locally and performs no outbound request.
Separate LFI from XXE
Store file-path and XML-parser evidence in separate findings. A common marker does not make them the same vulnerability class.
Prove it before moving on.
You can reproduce one traversal signal and one XXE signal without reading or contacting anything outside the lab.