Tool Spotlight: Catching Blind Bugs with ProjectDiscovery Interactsh

Every bug hunter remembers the first time they found a blind vulnerability. You send a payload that you know should work, but the server returns a pristine HTTP 200 OK with absolutely zero context or error messages. It is the cybersecurity equivalent of shouting into a void. You are left wondering if the server actually parsed your payload, or if a Web Application Firewall (WAF) quietly dropped it.

To solve this, researchers historically relied on tools like Burp Collaborator or custom VPS setups to catch Out-of-Band (OOB) interactions. When your target server processes a payload and makes a DNS lookup or HTTP request back to a domain you control, you have definitive proof of execution. However, custom setups are brittle, and commercial tools lock you into specific ecosystems.

Enter Interactsh by ProjectDiscovery.

Interactsh has become the de facto standard for OOB vulnerability testing. It is open-source, highly scriptable, seamlessly integrates into automated pipelines, and supports DNS, HTTP, HTTPS, SMTP, and LDAP interactions. If you are doing any kind of serious Cloud SSRF Hunting or automated blind injection testing, this tool is mandatory.

Why Interactsh Fits Perfectly into Modern Workflows

The problem Interactsh solves is simple: visibility into asynchronous and blind execution.

Imagine you are auditing a PDF generation endpoint. You inject an HTML payload containing a tracking pixel. The server queues the job, and five minutes later, a background worker processes the PDF. If that worker is vulnerable to Server-Side Request Forgery (SSRF) or Local File Inclusion (LFI) via HTML parsing, it will reach out to fetch your pixel.

If you are just watching your local proxy traffic, you will completely miss this interaction because it happened asynchronously, out-of-band, and from a completely different server than the one you originally attacked.

Interactsh gives you a unique, temporary domain (e.g., c5x8y9z0.interact.sh). You drop this domain into your payloads. When the backend worker reaches out, the Interactsh server logs the DNS lookup and the HTTP request, providing you with the exact timestamp, source IP, and headers of the vulnerable internal server.

An illustration of an out-of-band vulnerability test where a backend server asynchronously pings an external Interactsh instance.

Installation and Setup