Interactsh
Interactsh is a free out-of-band interaction server used to catch DNS and HTTP callbacks during vulnerability tests for pentesters on authorized targets.
0 upvotes · 0 downvotes
No ratings yet
- Pricing
- Free
- Platforms
- LinuxWindowsmacOS
- License
- Open source
- Reviewed
- Last reviewed 25 October 2026
What it is
A client and server from ProjectDiscovery that issues unique callback URLs and records when a target later contacts them. That proves out-of-band bugs such as blind SSRF or XXE without a direct response in the original request.
What it helps with
- Confirming blind SSRF, XXE, and similar out-of-band issues
- Catching DNS, HTTP, SMTP, and other interaction types
- Running your own server or using the hosted client endpoint
- Pairing callbacks with scanners that embed Interactsh URLs
Who it's for
Pentesters and AppSec engineers testing systems they own or are authorized to assess.
Worth knowing
ProjectDiscovery publishes a hosted endpoint and self-hosted server builds. Using it against systems without authorization is unlawful.
Do I have to host the server myself?
No, you can use the hosted client endpoint, or run your own server when you need private callbacks.
What pairs well with it?
In our view Nuclei templates often embed Interactsh URLs, and httpx or Katana help find candidate endpoints first.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.