Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Inspect TLS on an approved HTTPS target
Use WSHawk TLS Inspection to record protocol, certificate chain, hostname, expiry, issuer, and cipher observations. The HTTP-only Academy lab does not pretend to provide public PKI.
Compare CORS responses
Send Origin: https://attacker.invalid to /cors/secure and /cors/insecure. Inspect response headers rather than only the JSON body.
The insecure pair combines wildcard origin and credentials; the secure pair does not allow the foreign origin.
Validate WebSocket Origin
Connect to /ws-secure first with Origin http://127.0.0.1:5177, then with a foreign origin. Compare with /ws-insecure.
Secure rejects the foreign handshake; insecure accepts it.
Avoid status-only conclusions
CORS is enforced by browsers and depends on credentials and response readability. TLS observations need certificate and protocol evidence. Store the exact headers and handshake results.
Prove it before moving on.
Your evidence separates HTTPS transport properties, HTTP CORS policy, and WebSocket Origin enforcement.