Practice Pack

CWAP Module 04 — Blind & Out-of-Band XSS practice pack

Blind XSS is stored XSS whose sink you never see. Your payload waits in a queue until some staff member opens an internal tool that renders it. No reflection, no alert box, no error — the only signal it fired is an out-of-band callback. Each mini-lab below is isolated: it has its own inputs and its own sink, and shares this pack's one collector and staff bot.

Setup — your in-lab collector

This pack is self-contained: it ships its own collector, so you need no external service (no XSS Hunter / interactsh). Point every payload at:

/m04-p/collector?id=<your-unique-id>

Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Give each input its own id= so a returning callback tells you exactly which field fired. Example loader (choose your own unique id):

<img src="/m04-p/m04-p/collector?id=my-uniq-01">

You never see it fire — the callback on the Collector Log is your only proof.

Naked mini-labs (minimal — one input, one exploit each)

Drill the raw mechanic with zero noise: seed a loader in the single input, wait for the staff bot to render it, watch the callback land. No decoys, nothing to search.

support ticket body -> agent ticket viewer
display name -> admin user list
User-Agent header -> internal log viewer

Methodology mini-labs (realistic — you must search & correlate)

Now the real workflow: many inputs, only some reach a staff-viewed sink. Spray uniquely-tagged payloads across every input (form fields, profile, notes, request headers), watch the collector log, and correlate which input actually fired.

spray & correlate -> find the one true admin sink
Track your progress: /progress tallies every mini-lab · /collector-log shows every callback received.