E-INT
Interactsh
Open-source out-of-band interaction (OAST) tool for detecting blind vulnerabilities like SSRF, blind XXE, and blind SSTI.
OVERVIEW
Interactsh (github.com/projectdiscovery/interactsh) from ProjectDiscovery is an open-source out-of-band application security testing (OAST) system: it hands out unique, disposable subdomains that resolve to a server logging every DNS, HTTP, SMTP, and LDAP interaction that hits them. Plant one of those unique identifiers in a parameter suspected of SSRF, blind XXE, blind SSTI, or blind command injection, and a callback in the log is proof the payload executed somewhere out of the tester's direct view.
It ships both a public client (interact.sh, run by ProjectDiscovery) and a self-hostable server, so it works as a free alternative to Burp Collaborator when a client requires all testing infrastructure to stay on infrastructure the tester controls, and it integrates directly with other ProjectDiscovery tools like Nuclei for automated blind-vulnerability detection at scale.
USE CASES
Practical use cases
- 01
Confirming SSRF by planting a unique Interactsh URL in a parameter and watching for the callback.
- 02
Detecting blind XXE by embedding an Interactsh hostname in an external entity and checking for a DNS/HTTP hit.
- 03
Verifying blind SSTI or command injection where the response gives no visible indication of execution.
- 04
Self-hosting the server so all interaction data stays on infrastructure the client has approved, instead of a third party.
QUICK START
When a vulnerability class doesn't produce a visible response in-band — SSRF, blind XXE, blind SSTI, blind command injection — and you need a callback to prove it fired.
- Confirm out-of-band testing (traffic to an external interaction server) is permitted under the engagement's rules of engagement.
- Install the interactsh-client (or self-host the interactsh server on infrastructure you control).
- Generate a unique interaction URL/hostname for the session.
- Plant that identifier in the suspected injection point (a URL parameter, XML entity, template field).
- Poll the client for logged interactions and correlate a hit with the exact payload and timestamp that triggered it.
interactsh-client -vBEFORE YOU RUN IT
What to check before running it
Using the public interact.sh server sends interaction metadata (source IPs, payloads, timing) to ProjectDiscovery's infrastructure — confirm this is acceptable under the engagement's data-handling terms, or self-host instead.
A callback proves the payload reached and executed somewhere, but not necessarily on the target itself — confirm the interaction actually originated from the system under test before reporting it as confirmed.
Self-hosting requires a public IP/domain and open DNS/HTTP ports, which is itself infrastructure to secure and eventually decommission after the engagement.