Progress

0 / 4 mini-labs solved this session. A mini-lab only ticks when its callback reaches the collector — because in blind XSS the callback is the only proof it ever executed.

Naked (0 / 3)

⬜ Naked: support ticket body -> agent ticket viewer

⬜ Naked: display name -> admin user list

⬜ Naked: User-Agent header -> internal log viewer

Methodology (0 / 1)

⬜ Methodology: spray & correlate -> find the one true admin sink