An OOB interaction gathering server and client library

Features • Usage • Interactsh Client • Interactsh Server • Interactsh Integration • Join Discord

Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions.

Features

DNS/HTTP(S)/SMTP(S)/LDAP Interaction
IPv4 and IPv6 support
CLI / Web / Burp / ZAP / Docker client
AES encryption with zero logging
Automatic ACME based Wildcard TLS w/ Auto Renewal
DNS Entries for Cloud Metadata service
Dynamic HTTP Response control
Self-Hosted Interactsh Server
Multiple domain support (self-hosted)
NTLM/SMB/FTP(S)/RESPONDER Listener (self-hosted)
Wildcard / Protected Interactions (self-hosted)
Customizable Index / File hosting (self-hosted)
Client file hosting for second-stage OOB payloads (self-hosted)
Customizable Payload Length (self-hosted)
Custom SSL Certificate (self-hosted)

Interactsh Client

Usage

interactsh-client -h

This will display help for the tool. Here are all the switches it supports.

Usage:
  ./interactsh-client [flags]

Flags:
INPUT:
   -s, -server string   interactsh server(s) to use (default "oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me")
   -fl, -file string[]  local file(s) to upload and host on the interactsh server

CONFIG:
   -config string                           flag configuration file (default "$HOME/.config/interactsh-client/config.yaml")
   -auth                                    configure projectdiscovery cloud (pdcp) api key (default true)
   -n, -number int                          number of interactsh payload to generate (default 1)
   -t, -token string                        authentication token to connect protected interactsh server
   -pi, -poll-interval int                  poll interval in seconds to pull interaction data (default 5)
   -nf, -no-http-fallback                   disable http fallback registration
   -cidl, -correlation-id-length int        length of the correlation id preamble (min 3, default 20) (default 20)
   -cidn, -correlation-id-nonce-length int  length of the correlation id nonce (min 3, default 13) (default 13)
   -sf, -session-file string                store/read from session file
   -kai, -keep-alive-interval value         keep alive interval (default 1m0s)

FILTER:
   -m, -match string[]   match interaction based on the specified pattern
   -f, -filter string[]  filter interaction based on the specified pattern
   -dns-only             display only dns interaction in CLI output
   -http-only            display only http interaction in CLI output
   -smtp-only            display only smtp interactions in CLI output
   -asn                   include asn information of remote ip in json output

UPDATE:
   -up, -update                 update interactsh-client to latest version
   -duc, -disable-update-check  disable automatic interactsh-client update check

OUTPUT:
   -o string                         output file to write interaction data
   -json                             write output in JSON Lines format
   -ps, -payload-store               write generated interactsh payload to file
   -psf, -payload-store-file string  store generated interactsh payloads to given file (default "interactsh_payload.txt")
   -fsf, -file-store-file string     store hosted file URLs to given file (requires -file)
   -v                                display verbose interaction

DEBUG:
   -version            show version of the project
   -health-check, -hc  run diagnostic check up

Interactsh CLI Client

Interactsh Cli client requires go1.20+ to install successfully. Run the following command to get the repo -

go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

Configure PDCP_API_KEY With Interactsh CLI Client

Get your free api key by signing up at https://cloud.projectdiscovery.io

You can configure your PDCP_API_KEY in two ways:

To configure the API key interactively, run the following command:
```
./interactsh-client -auth
```
If you prefer to pass the API key directly, use the -auth option followed by your API key:
```
./interactsh-client -auth=<pdcp-api-key>
```

Default Run

This will generate a unique payload that can be used for OOB testing with minimal interaction information in the output.

$ interactsh-client

    _       __                       __       __  
   (_)___  / /____  _________ ______/ /______/ /_ 
  / / __ \/ __/ _ \/ ___/ __ '/ ___/ __/ ___/ __ \
 / / / / / /_/  __/ /  / /_/ / /__/ /_(__  ) / / /
/_/_/ /_/\__/\___/_/   \__,_/\___/\__/____/_/ /_/ v0.0.5

        projectdiscovery.io

[INF] Listing 1 payload for OOB Testing
[INF] c23b2la0kl1krjcrdj10cndmnioyyyyyn.oast.pro

[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received DNS interaction (A) from 172.253.226.100 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received DNS interaction (AAAA) from 32.3.34.129 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received HTTP interaction from 43.22.22.50 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received HTTPS interaction from 43.22.22.50 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received DNS interaction (MX) from 43.3.192.3 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received DNS interaction (TXT) from 74.32.183.135 at 2021-26-26 12:26
[c23b2la0kl1krjcrdj10cndmnioyyyyyn] Received SMTP interaction from 32.85.166.50 at 2021-26-26 12:26

Session File

interactsh-client with -sf, -session-file flag can be used store/read the current session information from user defined file which is useful to resume the same session to poll the interactions even after the client gets stopped or closed.

$ interactsh-client -sf interact.session

    _       __                       __       __  
   (_)___  / /____  _________ ______/ /______/ /_ 
  / / __ \/ __/ _ \/ ___/ __ '/ ___/ __/ ___/ __ \
 / / / / / /_/  __/ /  / /_/ / /__/ /_(__  ) / / /
/_/_/ /_/\__/\___/_/   \__,_/\___/\__/____/_/ /_/ 1.0.3

        projectdiscovery.io

[INF] Listing 1 payload for OOB Testing
[INF] c23b2la0kl1krjcrdj10cndmnioyyyyyn.oast.pro

interactsh

Most Popular