What address for server in 'untrusted input' and admin ?

Hello,

Now I'm on "Mobile Security Decisions via Untrusted Input" lesson. It was OK to launch the '********' activity, but it failed to fetch the result.

• first problem I encountered is that "address" field in preferences doesn't work if you only put IP or dns domain name (you have to prepend http:// or https:// to the server address), but the error message doesn't tell you this way (it just says "address should not be null" or something like that) ... maybe renaming this option would make it more clear that protocol is needed ? "Server URI" ? Set default value with http:// ?
• second problem: i'm unable to figure out which server is supposed to give the answer. By running nc -l 80on my machine and setting address to my IP, I was able to grasp an API key ('mobileKey'), but this is not the answer key, so where is the server supposed to answer to such a request ? (I tried http://my_owasp_instance/, of course, but it failed because of invalid certificates as owasp instance redirects to https, and from curl -k it gives me 404). Was there an initial value set for "server address" that I erased in my previous attempts ? (and is there a way to recover it without downloading the full OVA again ? - yes, I didn't made a copy...).

Of course, if this is part of the challenge, just tell me and close this report.

Note: digging into the code, the same API calls are made from "ShepherdLogin" app (MobileShepherd/ShepherdLogin/app/src/main/java/com/mobshep/shepherdlogin/LoggedIn.java)

Thanks!