I wanted my own blind-XSS callback infrastructure for authorized bug bounty work rather than relying on a shared hosted one, and building it was a good way to learn how these tools actually capture and attribute a fire-back.
What I built
A single setup script that stands up an Express server behind Nginx with a Let’s Encrypt certificate and a small SQLite store, kept running with PM2.
A dashboard that shows captures (source IP, origin, user agent, cookies, referer, and a page screenshot), plus a payload generator and multi-channel (Slack / Discord / email) notifications.
Screenshots
A walk through the build in screenshots. Click any to view it full size.
Fig 1Capture dashboard (lab captures on a CTF target)Fig 2Payload generator
What I learned
I have tested it against a CTF lab target to confirm the capture path works end to end; the dashboard in the screenshot shows those lab captures, not production findings.
I would only ever point this at targets I am authorized to test. The point of self-hosting was control over where the callback data goes.