[ self-hosted kit — authorized testing only ]
| x.y7c.me | blind-XSS / callback collector |
| webhook.y7c.me | OOB bins — HTTP + DNS + SMTP capture, correlated |
| mx.y7c.me | email sink — OOB test mail to *.oob.y7c.me |
| inbox.y7c.me | disposable @y7c.me inboxes — signups / 2FA codes |
| canary.y7c.me | canarytokens — URL / pixel / DNS / email tripwires |
| hdr.y7c.me | security-header & CORS analyzer (SSRF-guarded) |
| p.y7c.me | payload host — canned test payloads |
| jwt.y7c.me | JWT inspector (decodes in-browser) |
| redir.y7c.me | redirect-chain tracer (SSRF-guarded) |
| cc.y7c.me | CyberChef — encoding / crypto / data wrangling |
[ gated tools use single sign-on — log in once at auth.y7c.me ]
← tools.y7c.me · authorized security testing only · © 2026 Digital Gangster Enterprises, LLC