Blind XSS is stored XSS whose sink you never see. Your payload waits in a queue until some staff member opens an internal tool that renders it. No reflection, no alert box, no error — the only signal it fired is an out-of-band callback. Each mini-lab below is isolated: it has its own inputs and its own sink, and shares this pack's one collector and staff bot.
This pack is self-contained: it ships its own collector, so you need no external service (no XSS Hunter / interactsh). Point every payload at:
/m04-p/collector?id=<your-unique-id>
Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Give each input its own id= so a returning callback tells you exactly which field fired. Example loader (choose your own unique id):
<img src="/m04-p/m04-p/collector?id=my-uniq-01">
You never see it fire — the callback on the Collector Log is your only proof.
Drill the raw mechanic with zero noise: seed a loader in the single input, wait for the staff bot to render it, watch the callback land. No decoys, nothing to search.
Now the real workflow: many inputs, only some reach a staff-viewed sink. Spray uniquely-tagged payloads across every input (form fields, profile, notes, request headers), watch the collector log, and correlate which input actually fired.