How bugatsec/blind-xsstrace works
XSSTrace is a self-hosted Blind XSS callback server and hit dashboard. Testers place marker-specific payloads in injection points; when a payload fires, the server records callback details, groups and displays hits for an authenticated user, and can notify Discord. The README documents import/export, filters, page actions, and persistent storage. The source excerpt is partial, so uncertain API-to-storage wiring is omitted; the dashboard and server are monolithic files.
Main entry points: index.html Dashboard Client · server.js Callback Capture
Components 15
Payload Capture
- Express Server
server.js - Marker Payload Route
server.js - Callback Capture
server.js
Dashboard
- Dashboard Login
server.js - Dashboard UI
server.js - Dashboard Client
index.html - Hit Views and Filters
server.js - Page Group Actions
server.js - Import and Export
server.js - Health Check
server.js
Hit State and Alerts
- Callback Log
server.js
Other components
- Security Tester
- Affected Browser
- Discord Webhook
- Persistent Disk
Connections 14
- Security Tester → Affected Browser: embeds payload
- Affected Browser → Marker Payload Route: requests marker
- Marker Payload Route → Callback Capture: captures hit
- Callback Capture → Callback Log: records hit
- Callback Capture → Discord Webhook: sends alert
- Security Tester → Dashboard Login: opens dashboard
- Dashboard Login → Dashboard UI: serves page
- Dashboard UI → Dashboard Client: loads client
- Dashboard Client → Hit Views and Filters: requests and filters
- Hit Views and Filters → Callback Log: reads hits
- Dashboard Client → Page Group Actions: requests actions
- Dashboard Client → Import and Export: imports or exports
- Dashboard Client → Health Check: checks status
- Callback Log → Persistent Disk: persists log