A domain that I use for bb/pentest poc's for basic out of band comms.

SVG's are either based or copied from Brute Logic's amazing work. Self hosted to ensure I'm not putting clients at risk.

• potato.svg - svg image with a simple alertbox
• empty.svg - empty svg image with a simple alertbox
• redir.svg - reads params for a URL (?url=google.com) and optional warning (w=1)

JS files

• c.js will output to the console a simple message
• p.js will create a visual xss poc for screenshots/reporting. Also functional form which will output to the console.