Home / Setup

Welcome to the RatDesk help desk

RatDesk is a customer-support platform. Everything a customer submits — tickets, contact messages, profile details, order notes, uploads — is reviewed by staff inside internal dashboards you cannot see: the agent ticket viewer, the admin user list, an analytics log, the CRM, a fulfillment board, and a file browser.

Module 04 objective — Blind & Out-of-Band XSS

Blind XSS is stored XSS whose sink you never see. Your payload sits in a queue until some staff member opens the internal tool that renders it. You get no reflection, no alert box, no error — the only signal that it fired is an out-of-band callback your payload makes when it executes. That is why real blind-XSS hunting uses a collector (XSS Hunter, interactsh, a Burp Collaborator, your own server).

Setup — your in-lab collector

This lab is self-contained: it ships its own collector, so you do not need any external service. Point your payloads at:

/m04/collector?id=<your-unique-id>

Any resource load or script whose src/fetch hits that URL counts as an executing callback. A plain-text mention does not — it has to actually try to load, the way a browser would. Example shape of a remote-loader payload (choose your own unique id):

<img src="/m04/m04/collector?id=t1cket-AbC123">

Every callback shows up on the Collector Log with its id and a timestamp.

Method — seed widely, tag uniquely, wait, correlate

• Seed widely. You do not know which field lands in which staff tool, so plant a loader in every input you can reach — including request headers like User-Agent and Referer, not just form fields.
• Tag uniquely. Give each field its own id= (e.g. ticket-…, ua-…, ref-…). When a callback arrives you will know exactly which injection point fired.
• Wait. Staff review submissions on their own schedule (here, a bot opens the dashboards every few seconds). Nothing happens the instant you submit.
• Correlate. Watch the Collector Log; match the returning id back to the field you tagged.

You never see it fire — the callback is your proof.

Where to seed

Six reach a staff sink through the visible pages; two more ride in on your request headers with any submission:

Tip: headers are just another input. From the CLI you might do something like -H "User-Agent: <img src=/m04/collector?id=ua-XXXX>" on any request that submits a form.