ワンクリックでManusで任意のスキルを実行

interactsh-client

スター6

フォーク2

更新日2026年6月3日 05:58

[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

tr4m0ryp

tr4m0ryp/shor

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

interactsh-client — OOB/OAST confirmation

ProjectDiscovery's interactsh-client (Go, go install). Mints a unique interaction domain and records any DNS/HTTP/SMTP callback to it. The standard way to prove blind vulnerabilities: plant a unique-nonce subdomain in a payload, trigger it, and watch for the hit. Live → exploitation phase. Pairs with ssrfmap, nuclei -b, dalfox -b, and manual blind probes.

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.

このリポジトリの他の Skills

同じリポジトリ

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

interactsh-client — OOB/OAST confirmation

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).

-o out.jsonl persist interactions; -v verbose.

-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.

-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload interactsh-client -json -o interactions.jsonl # It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe: # url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").

Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.

name	interactsh-client
description	[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.