Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Map external fields
Configure Jira and DefectDojo mappings for stable ID, title, severity, confidence, status, endpoint, description, and sanitized evidence. Use preview/dry-run before sending.
Test the webhook
Post a sanitized test finding to /integrations/webhook and inspect /integrations/webhook/events. Reset the receiver afterward.
202 accepted and one locally recorded event.
Control credentials
Store integration tokens through the operating-system credential mechanism, never in project notes, requests, screenshots, or exported bundles.
Generate a local proxy CA
Use WSHawk certificate utilities to create a lab-only CA, inspect subject, serial, validity, and fingerprint, then install it only in a disposable test browser profile.
Remove trust after practice
Stop the proxy, delete the disposable browser profile, remove the CA from trust stores, and verify HTTPS no longer trusts the lab CA.
Prove it before moving on.
The webhook receives only sanitized data, external mappings pass preview, and the temporary proxy CA is removed after verification.