Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Fetch the reference sample
GET /binary/sample and store content type, byte length, SHA-256, and first bytes. Do not convert the body through UTF-8.
Send a binary frame
Connect to /ws and send a small binary buffer. The lab returns a JSON analysis frame and a binary WSHK response.
Inspect structure
Compare magic bytes, length fields, entropy hints, repeated offsets, and direction. Save the original bytes before trying a decoder.
Test codec hypotheses
Try JSON, MessagePack, protobuf, compression, or custom-structure decoders only when evidence supports them. Record schema and endianness assumptions.
Report limits
A recognized magic value or readable fragment is not proof of a security issue. Findings require a trust-boundary or validation failure.
Prove it before moving on.
The project preserves raw binary evidence, hashes, direction, metadata, and a clearly labeled codec hypothesis.