Teach Codex an authorized Windows web-lab, CTF, and simulated-real web assessment workflow using DVWA as the first reference environment. Use when Codex is given a DVWA module or an explicitly authorized lab URL, credentials when available, scope, output language, and report requirements. Codex should work like an agent-led tester: confirm authorization, inspect the live app and source when available, map routes/forms/APIs, form hypotheses, choose tools such as Playwright, Burp, ZAP, Python, ffuf, sqlmap, IDA, or MCP, capture screenshots, generate task-specific tests only when justified, validate from evidence, and produce Markdown reports with screenshots, logs, timing, findings, remediation, and no-solution analysis. For DVWA modules with no difficulty specified, progress upward until evidence says to stop. Helpers are supporting material, not answer keys or fixed scan workflows.
2026-06-08