Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Verify installed commands
Run wshawk --version and wshawk-defensive --help. Confirm the displayed product version and save the output with the project.
Use the standard CLI
Run a bounded scan against the local lab with one URL, one family, explicit timeout, low concurrency, and an output file. Review requests before increasing scope.
Use advanced and interactive modes
Use wshawk-advanced for deeper controls and wshawk-interactive for guided exploration. Confirm that interactive output does not bypass project scope or request limits.
Review in the dashboard
Start the local dashboard only on loopback, load the saved output, inspect findings and evidence, then stop it. Do not expose the dashboard publicly.
Prove it before moving on.
You can explain which interface you chose, reproduce the command, and locate its saved evidence.