Validate XXE and SSRF egress defenses

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health

Understand the validator

wshawk-defensive DNSExfiltrationTest checks whether an XXE or SSRF path can generate a controlled DNS/HTTP callback. It does not prove parser safety from one blocked request.

Use the local simulation

Reset /oast/interactions, send the documented XXE and SSRF requests to the insecure routes, and confirm the ledger correlates source and time.

Test the secure pair

Repeat against /xml-secure and /fetch-secure. Expect parser rejection or destination denial and no new interaction.

Move to a real environment safely

Use only a callback domain you control and an application explicitly authorized for egress testing. Coordinate monitoring and stop conditions with defenders.

Interpret results

A callback proves egress. No callback may mean validation, DNS filtering, network blocking, parser behavior, caching, or test failure; report it as bounded evidence, not absolute safety.