Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Compare header controls
Run Header Analysis on /headers/secure and /headers/insecure. Record CSP, nosniff, referrer policy, framing, Server, and X-Powered-By differences.
Fingerprint technologies
Use Technology Detection on the insecure response and crawl assets. Treat version banners as hints requiring validation, not proof of a vulnerable component.
Observe WAF behavior
Send a normal q value and then the documented UNION marker to /waf/simulated. Record block status and the simulated cloudflare signature.
Detect fake secrets
Scan /secrets/secure and /secrets/insecure. Verify context around the fake AWS key, JWT, private-key marker, and stack trace; confirm the secure pair is redacted.
Prove it before moving on.
The assessment separates missing headers, fingerprint hints, WAF behavior, and confirmed sensitive-pattern exposure.