Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
ac8d42e
feat: Add more control over custom DNS domains
Vasco-jofra Nov 11, 2025
ba583ab
chore(deps): bump github.com/projectdiscovery/gologger
dependabot[bot] Feb 2, 2026
e0588fe
chore(deps): bump github.com/projectdiscovery/retryablehttp-go
dependabot[bot] Feb 2, 2026
98d8109
chore(deps): bump github.com/projectdiscovery/fastdialer
dependabot[bot] Feb 2, 2026
61e9813
Merge pull request #1331 from projectdiscovery/dependabot/go_modules/…
dogancanbakir Feb 11, 2026
4a53b31
Merge pull request #1329 from projectdiscovery/dependabot/go_modules/…
dogancanbakir Feb 11, 2026
e553849
Merge pull request #1328 from projectdiscovery/dependabot/go_modules/…
dogancanbakir Feb 11, 2026
e937039
chore(deps): bump github.com/projectdiscovery/hmap
dependabot[bot] Feb 11, 2026
1a4b2cc
Merge pull request #1330 from projectdiscovery/dependabot/go_modules/…
dogancanbakir Feb 24, 2026
2c3dfb3
merge dev and resolve conflicts
dogancanbakir Feb 24, 2026
609ac8c
validate IPs and log errors in custom DNS record handling
dogancanbakir Feb 24, 2026
aab1b78
fix: differentiate HTTP vs HTTPS protocol in interactions
dogancanbakir Feb 24, 2026
a7751f3
Merge pull request #1338 from projectdiscovery/fix/http-https-protoco…
dogancanbakir Feb 24, 2026
4e74587
fix: wildcard server sends interactions to all clients (#1296)
dogancanbakir Feb 25, 2026
da91f8e
fix: interaction data corruption causing unmarshal errors
dogancanbakir Feb 26, 2026
70580fa
use jsoniter.Marshal in round-trip tests
dogancanbakir Mar 4, 2026
60b6e00
Merge pull request #1341 from projectdiscovery/fix/interaction-unmars…
dogancanbakir Mar 4, 2026
4573152
bump version
dogancanbakir Mar 5, 2026
fe9869d
Merge pull request #1339 from projectdiscovery/fix/wildcard-multi-cli…
dogancanbakir Mar 5, 2026
989a1c9
Merge pull request #1288 from Vasco-jofra/VF/dns-better-custom-records
dogancanbakir Mar 9, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 25 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ interactsh-client | notify

## Interactsh Web Client

[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **interact.sh** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well.
[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix typo: "authencaited" → "authenticated".

The word "authencaited" is misspelled and should be "authenticated".

📝 Proposed fix
-[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well.
+[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authenticated interactsh servers as well.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well.
[Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authenticated interactsh servers as well.
🧰 Tools
🪛 LanguageTool

[grammar] ~251-~251: Ensure spelling is correct
Context: ..., and supports other self-hosted public/authencaited interactsh servers as well. A hosted i...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@README.md` at line 251, The README contains a typo in the sentence describing
supported servers: replace the misspelled word "authencaited" with
"authenticated" in the paragraph that reads "supports other self-hosted
public/authencaited interactsh servers as well" so it becomes "supports other
self-hosted public/authenticated interactsh servers as well"; update that exact
phrase in README.md.


A hosted instance of **interactsh-web** client is available at https://app.interactsh.com

Expand Down Expand Up @@ -277,9 +277,9 @@ $ docker run projectdiscovery/interactsh-client:latest
[INF] c59e3crp82ke7bcnedq0cfjqdpeyyyyyn.oast.pro
```

## Burp Suite Extension
## Burp Suite Original Extension

[interactsh-collaborator](https://github.com/wdahlenburg/interactsh-collaborator) is Burp Suite extension developed and maintained by [@wdahlenb](https://twitter.com/wdahlenb)
[interactsh-collaborator](https://github.com/wdahlenburg/interactsh-collaborator) is an original Burp Suite interactsh extension developed and maintained by [@wdahlenb](https://twitter.com/wdahlenb)

- Download latest JAR file from [releases](https://github.com/wdahlenburg/interactsh-collaborator/releases) page.
- Open Burp Suite → Extender → Add → Java → Select JAR file → Next
Expand All @@ -288,9 +288,20 @@ $ docker run projectdiscovery/interactsh-client:latest

<img width="2032" alt="burp" src="https://user-images.githubusercontent.com/8293321/135176099-0e3fa01c-bdce-4f04-a94f-de0a34c7abf6.png">

## OWASP ZAP Add-On
## Burp Suite Revised Extension

Interactsh can be used with OWASP ZAP via the [OAST add-on for ZAP](https://www.zaproxy.org/docs/desktop/addons/oast-support/). With ZAP's scripting capabilities, you can create powerful out-of-band scan rules that leverage Interactsh's features. A standalone script template has been provided as an example (it is added automatically when you install the add-on).
[interactsh-collaborator-rev](https://github.com/TheArqsz/interactsh-collaborator-rev) is a revised version of the original Burp Suite interactsh extension and is developed and maintained by [@Arqsz](https://arqsz.net/)

- Download latest JAR file from [releases](https://github.com/TheArqsz/interactsh-collaborator-rev/releases) page.
- Open Burp Suite &rarr; Extender &rarr; Add &rarr; Java &rarr; Select JAR file &rarr; Next
- New tab named **Interactsh** will be appeared upon successful installation.
- See the [interactsh-collaborator-rev](https://github.com/TheArqsz/interactsh-collaborator-rev) project for more info.

<img width="2032" alt="burp" src="https://github.com/TheArqsz/interactsh-collaborator-rev/blob/master/assets/interactsh-extension.png?raw=true">

## ZAP Add-On

Interactsh can be used with ZAP via the [OAST add-on for ZAP](https://www.zaproxy.org/docs/desktop/addons/oast-support/). With ZAP's scripting capabilities, you can create powerful out-of-band scan rules that leverage Interactsh's features. A standalone script template has been provided as an example (it is added automatically when you install the add-on).

- Install the OAST add-on from the [ZAP Marketplace](https://www.zaproxy.org/addons/).
- Go to Tools &rarr; Options &rarr; OAST and select **Interactsh**.
Expand All @@ -303,9 +314,6 @@ Interactsh can be used with OWASP ZAP via the [OAST add-on for ZAP](https://www.
![zap](https://user-images.githubusercontent.com/16446369/135211920-ed24ba5a-5547-4cd4-b6d8-656af9592c20.png)
*Interactsh in ZAP*

![Options > OAST > General](https://github.com/hahwul/interactsh/assets/13212227/005bb527-3f60-4822-8b76-f9a3fd06df83)
*`Options` > `OAST` > `General`*

## Caido Extension

[quickssrf](https://github.com/caido-community/quickssrf) is Caido extension developed and maintained which allows using Interactsh from within Caido Proxy.
Expand Down Expand Up @@ -700,6 +708,13 @@ $ interactsh-server -domain hackwithautomation.com -wildcard
[DNS] Listening on UDP 157.230.223.165:53
```

In wildcard mode, each connected client independently receives all interactions for the shared domain. The server keeps a buffer of recent interactions so that multiple clients can poll without missing data. By default, the buffer holds up to **10,000** interactions per shared key. This can be adjusted via the `INTERACTSH_MAX_SHARED_INTERACTIONS` environment variable:

```console
$ export INTERACTSH_MAX_SHARED_INTERACTIONS=50000
$ interactsh-server -domain hackwithautomation.com -wildcard
```
Comment on lines +713 to +716

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix markdownlint MD014 in the new example block.

Lines 706-707 use shell prompts without output. Prefer a bash block without $ prefixes.

Proposed patch
-```console
-$ export INTERACTSH_MAX_SHARED_INTERACTIONS=50000
-$ interactsh-server -domain hackwithautomation.com -wildcard
+```bash
+export INTERACTSH_MAX_SHARED_INTERACTIONS=50000
+interactsh-server -domain hackwithautomation.com -wildcard
</details>

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.21.0)</summary>

[warning] 706-706: Dollar signs used before commands without showing output

(MD014, commands-show-output)

---

[warning] 707-707: Dollar signs used before commands without showing output

(MD014, commands-show-output)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @README.md around lines 705 - 708, Change the fenced code block from using
the "console" language with "$" prompts to a "bash" block without "$" prefixes:
remove the leading "$ " on the two lines referencing the
INTERACTSH_MAX_SHARED_INTERACTIONS environment variable and the
interactsh-server command, and update the block fence language from "console" to
"bash" so the block becomes a plain bash snippet (affecting the lines that set
INTERACTSH_MAX_SHARED_INTERACTIONS and call interactsh-server).


</details>

<!-- fingerprinting:phantom:poseidon:hawk -->

<!-- This is an auto-generated comment by CodeRabbit -->


## LDAP Interaction

As default, Interactsh server support LDAP interaction for the payload included in [search query](https://ldapwiki.com/wiki/LDAP%20Query%20Examples), additionally `ldap` flag can be used for complete logging.
Expand Down Expand Up @@ -871,8 +886,8 @@ Currently supported metadata services:

Example:

* **aws.interact.sh** points to 169.254.169.254
* **alibaba.interact.sh** points to 100.100.100.200
* **aws.oast.fun** points to 169.254.169.254
* **alibaba.oast.fun** points to 100.100.100.200

-----

Expand Down
97 changes: 91 additions & 6 deletions cmd/interactsh-server/example-custom-records.yaml
Original file line number Diff line number Diff line change
@@ -1,8 +1,93 @@
# This is a reference custom DNS records file
#
# Custom DNS records can be specified in two formats:
#
# 1. Standard format (supports multiple record types):
# subdomain:
# - type: RECORD_TYPE
# value: "record_value"
# ttl: 3600 # optional, defaults to server TTL
# priority: 10 # optional, for MX records only
#
# 2. LEGACY FORMAT (Simple key-value, assumes A records):
# subdomain: "ip_address"
#
# Supported record types: A, AAAA, CNAME, MX, TXT, NS

# The default custom records can be specified using this YAML
# file using the below declaration.
aws: "169.254.169.254"
alibaba: "100.100.100.200"
localhost: "127.0.0.1"
oracle: "192.0.0.192"
# ============================================
# STANDARD FORMAT EXAMPLES
# ============================================

# A record example
api:
- type: A
value: "192.0.2.1"
ttl: 3600

# Multiple A records for the same subdomain
webserver:
- type: A
value: "203.0.113.10"
- type: A
value: "203.0.113.11"

# AAAA record (IPv6)
ipv6:
- type: AAAA
value: "2001:db8::1"

# CNAME record
cdn:
- type: CNAME
value: "example.cdn.net"

# MX record (mail server)
mail:
- type: MX
value: "mail.example.com"
priority: 10
ttl: 7200

# Multiple MX records with different priorities
mailserver:
- type: MX
value: "mail1.example.com"
priority: 10
- type: MX
value: "mail2.example.com"
priority: 20

# TXT record (useful for SPF, DKIM, verification, etc.)
spf:
- type: TXT
value: "v=spf1 include:_spf.example.com ~all"

# Multi-level subdomain example (DKIM key)
something._domainkey:
- type: TXT
value: "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

# NS record (nameserver)
custom-ns:
- type: NS
value: "ns1.example.com"
- type: NS
value: "ns2.example.com"

# Mixed record types for the same subdomain
multi:
- type: A
value: "198.51.100.1"
- type: AAAA
value: "2001:db8::2"
- type: TXT
value: "v=spf1 mx ~all"

# ============================================
# LEGACY FORMAT EXAMPLES (backwards compatible)
# ============================================
# These simple entries will be interpreted as A records
# aws: "169.254.169.254"
# alibaba: "100.100.100.200"
# localhost: "127.0.0.1"
# oracle: "192.0.0.192"
5 changes: 5 additions & 0 deletions cmd/interactsh-server/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,11 @@ func main() {
}
storeOptions.DbPath = cliOptions.DiskStoragePath
}
if v := os.Getenv("INTERACTSH_MAX_SHARED_INTERACTIONS"); v != "" {
if n, err := strconv.Atoi(v); err == nil && n > 0 {
storeOptions.MaxSharedInteractions = n
}
}

var err error
store, err = storage.New(&storeOptions)
Expand Down
8 changes: 4 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,10 @@ require (
github.com/pkg/errors v0.9.1
github.com/projectdiscovery/asnmap v1.1.1
github.com/projectdiscovery/goflags v0.1.74
github.com/projectdiscovery/gologger v1.1.67
github.com/projectdiscovery/gologger v1.1.68
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb
github.com/projectdiscovery/retryabledns v1.0.113
github.com/projectdiscovery/retryablehttp-go v1.3.5
github.com/projectdiscovery/retryablehttp-go v1.3.6
github.com/projectdiscovery/utils v0.9.0
github.com/remeh/sizedwaitgroup v1.0.0
github.com/rs/xid v1.6.0
Expand Down Expand Up @@ -102,8 +102,8 @@ require (
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/projectdiscovery/blackrock v0.0.1 // indirect
github.com/projectdiscovery/fastdialer v0.5.3 // indirect
github.com/projectdiscovery/hmap v0.0.99 // indirect
github.com/projectdiscovery/fastdialer v0.5.4 // indirect
github.com/projectdiscovery/hmap v0.0.100 // indirect
github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 // indirect
github.com/projectdiscovery/mapcidr v1.1.97 // indirect
github.com/projectdiscovery/networkpolicy v0.1.34 // indirect
Expand Down
16 changes: 8 additions & 8 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -288,14 +288,14 @@ github.com/projectdiscovery/asnmap v1.1.1 h1:ImJiKIaACOT7HPx4Pabb5dksolzaFYsD1kI
github.com/projectdiscovery/asnmap v1.1.1/go.mod h1:QT7jt9nQanj+Ucjr9BqGr1Q2veCCKSAVyUzLXfEcQ60=
github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ=
github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss=
github.com/projectdiscovery/fastdialer v0.5.3 h1:Io57Q37ouFzrPK53ZdzK6jsELgqjIMCWcoDs+lRDGMA=
github.com/projectdiscovery/fastdialer v0.5.3/go.mod h1:euoxS1E93LDnl0OnNN0UALedAFF+EehBxyU3z+79l0g=
github.com/projectdiscovery/fastdialer v0.5.4 h1:+0oesDDqZcIPE5bNDmm/Xm9Xm3yjnhl4xwP+h5D1TE4=
github.com/projectdiscovery/fastdialer v0.5.4/go.mod h1:KCzt6WnSAj9umiUBRCaC0EJSEyeshxDoowfwjxodmQw=
github.com/projectdiscovery/goflags v0.1.74 h1:n85uTRj5qMosm0PFBfsvOL24I7TdWRcWq/1GynhXS7c=
github.com/projectdiscovery/goflags v0.1.74/go.mod h1:UMc9/7dFz2oln+10tv6cy+7WZKTHf9UGhaNkF95emh4=
github.com/projectdiscovery/gologger v1.1.67 h1:GZU3AjYiJvcwJT5TlfIv+152/TVmaz62Zyn3/wWXlig=
github.com/projectdiscovery/gologger v1.1.67/go.mod h1:35oeQP6wvj58S+o+Km6boED/t786FXQkI0exhFHJbNE=
github.com/projectdiscovery/hmap v0.0.99 h1:XPfLnD3CUrMqVCIdpK9ozD7Xmp3simx3T+2j4WWhHnU=
github.com/projectdiscovery/hmap v0.0.99/go.mod h1:koyUJi83K5G3w35ZLFXOYZIyYJsO+6hQrgDDN1RBrVE=
github.com/projectdiscovery/gologger v1.1.68 h1:KfdIO/3X7BtHssWZuqhxPZ+A946epCCx2cz+3NnRAnU=
github.com/projectdiscovery/gologger v1.1.68/go.mod h1:Xae0t4SeqJVa0RQGK9iECx/+HfXhvq70nqOQp2BuW+o=
github.com/projectdiscovery/hmap v0.0.100 h1:DBZ3Req9lWf4P1YC9PRa4eiMvLY0Uxud43NRBcocPfs=
github.com/projectdiscovery/hmap v0.0.100/go.mod h1:2O06pR8pHOP9wSmxAoxuM45U7E+UqOqOdlSIeddM0bA=
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb h1:MGtI4oE12ruWv11ZlPXXd7hl/uAaQZrFvrIDYDeVMd8=
github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb/go.mod h1:vmgC0DTFCfoCLp0RAfsfYTZZan0QMVs+cmTbH6blfjk=
github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 h1:eR+0HE//Ciyfwy3HC7fjRyKShSJHYoX2Pv7pPshjK/Q=
Expand All @@ -306,8 +306,8 @@ github.com/projectdiscovery/networkpolicy v0.1.34 h1:TRwNbgMwdx3NC190TKSLwtTvr0J
github.com/projectdiscovery/networkpolicy v0.1.34/go.mod h1:GJ20E7fJoA2vk8ZBSa1Cvc5WyP8RxglF5bZmYgK8jag=
github.com/projectdiscovery/retryabledns v1.0.113 h1:s+DAzdJ8XhLxRgt5636H0HG9OqHsGRjX9wTrLSTMqlQ=
github.com/projectdiscovery/retryabledns v1.0.113/go.mod h1:+DyanDr8naxQ2dRO9c4Ezo3NHHXhz8L0tTSRYWhiwyA=
github.com/projectdiscovery/retryablehttp-go v1.3.5 h1:6UXSJOEeeSE/IpI4xPrKRhSLkk3itNajfbgH91WtPPc=
github.com/projectdiscovery/retryablehttp-go v1.3.5/go.mod h1:2ma5Itx44tgfZCtHqnI7xbWEmsLXt1qXh+oOaJfmA+g=
github.com/projectdiscovery/retryablehttp-go v1.3.6 h1:dLb0/YVX+oX70gpWxN5GXT8pCKpn8fdXfwOq2TsXxNY=
github.com/projectdiscovery/retryablehttp-go v1.3.6/go.mod h1:tKVxmL4ixWy1MjYk5GJvFL0Cp10fnQgSp2F6bSBEypI=
github.com/projectdiscovery/utils v0.9.0 h1:eu9vdbP0VYXI9nGSLfnOpUqBeW9/B/iSli7U8gPKZw8=
github.com/projectdiscovery/utils v0.9.0/go.mod h1:zcVu1QTlMi5763qCol/L3ROnbd/UPSBP8fI5PmcnF6s=
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
Expand Down
1 change: 1 addition & 0 deletions pkg/client/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
gologger.Error().Msgf("Could not decrypt interaction: %v\n", err)
continue
}
plaintext = bytes.TrimRight(plaintext, " \t\r\n")
interaction := &server.Interaction{}
if err := jsoniter.Unmarshal(plaintext, interaction); err != nil {
gologger.Error().Msgf("Could not unmarshal interaction data interaction: %v\n", err)
Expand Down
2 changes: 1 addition & 1 deletion pkg/options/utils.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import (
updateutils "github.com/projectdiscovery/utils/update"
)

const Version = "1.3.0"
const Version = "1.3.1"

var banner = (`
_ __ __ __
Expand Down
Loading
Loading