Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Practice HTTP Forge
Send GET, POST, PATCH, PUT, and DELETE only to the documented lab endpoints. Inspect raw headers, redirects, timing, body encoding, and final URL.
Create the first chain step
POST /api/bootstrap with user_a and use Regex Extractor to capture token and next from the JSON response.
POST /api/bootstrap
{"username":"user_a"}Template the next request
Set Authorization: Bearer {{token}} and request {{next}}. Run one iteration and verify the returned identity is user_a.
chain_complete true with regex-extraction-and-template-substitution-worked.
Control failure
Remove the extractor or corrupt the token and rerun. The chain must stop or return 401; it must not silently reuse an old value.
Save the protocol map
Store both flows, variables, dependency edge, sanitized requests, response hashes, and replay order in the project timeline.
Prove it before moving on.
A clean project can replay the two-step chain deterministically and fails closed when extraction fails.