一键在 Manus 中运行任何 Skill

interactsh-client

星标6

分支2

更新时间2026年6月3日 05:58

[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

tr4m0ryp

tr4m0ryp/shor

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

interactsh-client — OOB/OAST confirmation

ProjectDiscovery's interactsh-client (Go, go install). Mints a unique interaction domain and records any DNS/HTTP/SMTP callback to it. The standard way to prove blind vulnerabilities: plant a unique-nonce subdomain in a payload, trigger it, and watch for the hit. Live → exploitation phase. Pairs with ssrfmap, nuclei -b, dalfox -b, and manual blind probes.

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.

同仓库更多 Skills

同仓库

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

name	interactsh-client
description	[exploit] Out-of-band (OAST) interaction listener — generates a unique callback domain and logs DNS/HTTP/SMTP hits to it. Reach for it to confirm blind SSRF/RCE/XXE/blind-XSS where no response comes back in-band.

interactsh-client — OOB/OAST confirmation

When to reach for it

Blind SSRF (no body returned), blind RCE/command-exec, blind XXE, blind/stored XSS — anywhere only an out-of-band signal can confirm the bug.

Key flags

-json structured per-interaction output (prefer for parsing).
-o out.jsonl persist interactions; -v verbose.
-s <server> self-hosted interactsh server (else the public default); -n <n> number of payloads to pre-generate.
-poll-interval <s> polling cadence. On start it prints the payload domain to use.

Safe invocation

# Start the listener; copy the printed payload domain into your SSRF/RCE payload
interactsh-client -json -o interactions.jsonl
# It prints e.g. cXXXX.oast.fun — embed a unique nonce per probe:
#   url=http://$(openssl rand -hex 4).cXXXX.oast.fun/

Evidence to capture

The interaction record: protocol (DNS/HTTP), the unique nonce subdomain, the source IP, and timestamp. A callback from the target's egress IP carrying your nonce is the proof that closes a blind finding.

Scope & rate caveats

The callback domain must be reachable from the target — OOB confirmation needs outbound egress to be allowed; if egress is locked down, OOB may not fire (note this as a blocker rather than concluding "not vulnerable").
Use a fresh nonce per probe so callbacks are unambiguous. This tool only listens; it generates no target load. Prefer the self-hosted -s server when policy forbids third-party OAST infrastructure.