Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Compare reflected contexts
Send the same marker to reflected-secure and reflected-insecure. Inspect the raw response before trying script-like syntax.
GET /xss/reflected-insecure?q=%3Cimg%20src%3Dx%20onerror%3Dwshawk_xss_probe%3D1%3EThe secure route encodes angle brackets; the vulnerable route preserves the element.
Verify DOM behavior
Open DOM Invader and target the URL fragment. The secure page assigns textContent; the insecure page assigns innerHTML.
http://127.0.0.1:5177/xss/dom-insecure#%3Cimg%20src%3Dx%20onerror%3Dwshawk_xss_probe%3D1%3EThe browser verifier observes the marker only on the insecure sink.
Use an isolated context
Enable headless Chromium verification, set a short timeout, and capture a screenshot. Do not reuse a browser profile containing real cookies or storage.
Classify the result
Reflection alone is a candidate. Executed marker plus context and screenshot is confirmed XSS. Record CSP and encoding behavior with the finding.
Prove it before moving on.
The finding distinguishes encoded reflection, unsafe reflection, and verified DOM execution.