Run the WebSocket scanner and Smart Payload Evolution

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health

Connect to the scanner endpoint

Open /ws-vulnerable and send a harmless scan action before adding an injection marker.

{"action":"scan","input":"academy"}

Mark the input field

Configure input as the only injection point. Run sqli, xss, command_injection, nosql_injection, path_traversal, xxe, ssrf, prototype_pollution, and redirect one family at a time.

Enable SPE cautiously

Generate a small mutation set from one base payload. Review that mutations stay in input, keep the JSON valid, and do not change identity, action, room, or target.

Correlate signals

Compare family, marker, reflected value, response hash, and any local OAST record. Consolidate duplicate mutations into one candidate.

Bound execution

Keep one connection, one worker, queue below 100 frames, request cap below 25, explicit timeout, and working Cancel. A hanging scan is a failed test.