Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

interactsh-client

Étoiles6

Forks2

Mis à jour3 juin 2026 à 05:58

[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

tr4m0ryp

tr4m0ryp/shor

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	interactsh-client
description	[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

interactsh-client — OOB/OAST confirmation

ProjectDiscovery's interactsh-client (Go, go install). Mints a unique interaction domain and records any DNS/HTTP/SMTP callback to it. The standard way to prove blind vulnerabilities: plant a unique-nonce subdomain in a payload, trigger it, and watch for the hit. Live → exploitation phase. Pairs with ssrfmap, nuclei -b, dalfox -b, and manual blind probes.

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.

Plus depuis ce dépôt

même dépôt

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

interactsh-client — OOB/OAST confirmation

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).

-o out.jsonl persist interactions; -v verbose.

-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.

-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload interactsh-client -json -o interactions.jsonl # It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe: # url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").

Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.