원클릭으로 Manus에서 모든 스킬 실행

interactsh-client

스타6

포크2

업데이트2026년 6월 3일 05:58

[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

tr4m0ryp

tr4m0ryp/shor

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

interactsh-client — OOB/OAST confirmation

ProjectDiscovery's interactsh-client (Go, go install). Mints a unique interaction domain and records any DNS/HTTP/SMTP callback to it. The standard way to prove blind vulnerabilities: plant a unique-nonce subdomain in a payload, trigger it, and watch for the hit. Live → exploitation phase. Pairs with ssrfmap, nuclei -b, dalfox -b, and manual blind probes.

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.

이 저장소의 다른 Skills

같은 저장소

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

name	interactsh-client
description	[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

interactsh-client — OOB/OAST confirmation

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.