[ self-hosted kit — authorized testing only ]
| x.y7c.me | blind-XSS / callback collector |
| webhook.y7c.me | OOB bins — HTTP + DNS + SMTP capture, correlated |
| mx.y7c.me | email sink — mail to *.oob.y7c.me / @y7c.me |
| hdr.y7c.me | security-header & CORS analyzer (SSRF-guarded) |
| p.y7c.me | payload host — canned test payloads |
| jwt.y7c.me | JWT inspector (decodes in-browser) |
| redir.y7c.me | redirect-chain tracer (SSRF-guarded) |
| cc.y7c.me | CyberChef — encoding / crypto / data wrangling |
[ gated tools use single sign-on — log in once at auth.y7c.me ]
y7c // authorized security testing only