Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Seed the crawler
Set /crawl/start as the only seed, same-origin only, depth 3, request cap 50, and one worker. Disable form submission during discovery.
GET http://127.0.0.1:5177/crawl/startAccount, API docs, preference form, script, and API references are discovered.
Read machine indexes
Fetch robots.txt, sitemap.xml, openapi.json, swagger.json, and .well-known/security.txt. Mark whether each URL was linked, documented, or guessed.
Run the directory scanner
Use a tiny lab list: admin, api, backup, graphql, missing-path. Calibrate with at least two random nonexistent paths before accepting matches.
Handle soft 404s
Compare status, length, normalized title, body hash, and redirect destination. Do not report a directory when it matches the nonexistent baseline.
Prove it before moving on.
Your map identifies every endpoint source and excludes the nonexistent control.