-
Notifications
You must be signed in to change notification settings - Fork 473
release interactsh v1.3.1 #1343
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
ac8d42e
ba583ab
e0588fe
98d8109
61e9813
4a53b31
e553849
e937039
1a4b2cc
2c3dfb3
609ac8c
aab1b78
a7751f3
4e74587
da91f8e
70580fa
60b6e00
4573152
fe9869d
989a1c9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -248,7 +248,7 @@ interactsh-client | notify | |
|
|
||
| ## Interactsh Web Client | ||
|
|
||
| [Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **interact.sh** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well. | ||
| [Interactsh-web](https://github.com/projectdiscovery/interactsh-web) is a free and open-source web client that displays Interactsh interactions in a well-managed dashboard in your browser. It uses the browser's local storage to store and display all incoming interactions. By default, the web client is configured to use **oast.fun** as default interactsh server, and supports other self-hosted public/authencaited interactsh servers as well. | ||
|
|
||
| A hosted instance of **interactsh-web** client is available at https://app.interactsh.com | ||
|
|
||
|
|
@@ -277,9 +277,9 @@ $ docker run projectdiscovery/interactsh-client:latest | |
| [INF] c59e3crp82ke7bcnedq0cfjqdpeyyyyyn.oast.pro | ||
| ``` | ||
|
|
||
| ## Burp Suite Extension | ||
| ## Burp Suite Original Extension | ||
|
|
||
| [interactsh-collaborator](https://github.com/wdahlenburg/interactsh-collaborator) is Burp Suite extension developed and maintained by [@wdahlenb](https://twitter.com/wdahlenb) | ||
| [interactsh-collaborator](https://github.com/wdahlenburg/interactsh-collaborator) is an original Burp Suite interactsh extension developed and maintained by [@wdahlenb](https://twitter.com/wdahlenb) | ||
|
|
||
| - Download latest JAR file from [releases](https://github.com/wdahlenburg/interactsh-collaborator/releases) page. | ||
| - Open Burp Suite → Extender → Add → Java → Select JAR file → Next | ||
|
|
@@ -288,9 +288,20 @@ $ docker run projectdiscovery/interactsh-client:latest | |
|
|
||
| <img width="2032" alt="burp" src="https://user-images.githubusercontent.com/8293321/135176099-0e3fa01c-bdce-4f04-a94f-de0a34c7abf6.png"> | ||
|
|
||
| ## OWASP ZAP Add-On | ||
| ## Burp Suite Revised Extension | ||
|
|
||
| Interactsh can be used with OWASP ZAP via the [OAST add-on for ZAP](https://www.zaproxy.org/docs/desktop/addons/oast-support/). With ZAP's scripting capabilities, you can create powerful out-of-band scan rules that leverage Interactsh's features. A standalone script template has been provided as an example (it is added automatically when you install the add-on). | ||
| [interactsh-collaborator-rev](https://github.com/TheArqsz/interactsh-collaborator-rev) is a revised version of the original Burp Suite interactsh extension and is developed and maintained by [@Arqsz](https://arqsz.net/) | ||
|
|
||
| - Download latest JAR file from [releases](https://github.com/TheArqsz/interactsh-collaborator-rev/releases) page. | ||
| - Open Burp Suite → Extender → Add → Java → Select JAR file → Next | ||
| - New tab named **Interactsh** will be appeared upon successful installation. | ||
| - See the [interactsh-collaborator-rev](https://github.com/TheArqsz/interactsh-collaborator-rev) project for more info. | ||
|
|
||
| <img width="2032" alt="burp" src="https://github.com/TheArqsz/interactsh-collaborator-rev/blob/master/assets/interactsh-extension.png?raw=true"> | ||
|
|
||
| ## ZAP Add-On | ||
|
|
||
| Interactsh can be used with ZAP via the [OAST add-on for ZAP](https://www.zaproxy.org/docs/desktop/addons/oast-support/). With ZAP's scripting capabilities, you can create powerful out-of-band scan rules that leverage Interactsh's features. A standalone script template has been provided as an example (it is added automatically when you install the add-on). | ||
|
|
||
| - Install the OAST add-on from the [ZAP Marketplace](https://www.zaproxy.org/addons/). | ||
| - Go to Tools → Options → OAST and select **Interactsh**. | ||
|
|
@@ -303,9 +314,6 @@ Interactsh can be used with OWASP ZAP via the [OAST add-on for ZAP](https://www. | |
|  | ||
| *Interactsh in ZAP* | ||
|
|
||
|  | ||
| *`Options` > `OAST` > `General`* | ||
|
|
||
| ## Caido Extension | ||
|
|
||
| [quickssrf](https://github.com/caido-community/quickssrf) is Caido extension developed and maintained which allows using Interactsh from within Caido Proxy. | ||
|
|
@@ -700,6 +708,13 @@ $ interactsh-server -domain hackwithautomation.com -wildcard | |
| [DNS] Listening on UDP 157.230.223.165:53 | ||
| ``` | ||
|
|
||
| In wildcard mode, each connected client independently receives all interactions for the shared domain. The server keeps a buffer of recent interactions so that multiple clients can poll without missing data. By default, the buffer holds up to **10,000** interactions per shared key. This can be adjusted via the `INTERACTSH_MAX_SHARED_INTERACTIONS` environment variable: | ||
|
|
||
| ```console | ||
| $ export INTERACTSH_MAX_SHARED_INTERACTIONS=50000 | ||
| $ interactsh-server -domain hackwithautomation.com -wildcard | ||
| ``` | ||
|
Comment on lines
+713
to
+716
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix markdownlint MD014 in the new example block. Lines 706-707 use shell prompts without output. Prefer a Proposed patch-```console
-$ export INTERACTSH_MAX_SHARED_INTERACTIONS=50000
-$ interactsh-server -domain hackwithautomation.com -wildcard
+```bash
+export INTERACTSH_MAX_SHARED_INTERACTIONS=50000
+interactsh-server -domain hackwithautomation.com -wildcardVerify each finding against the current code and only fix it if needed. In |
||
|
|
||
| ## LDAP Interaction | ||
|
|
||
| As default, Interactsh server support LDAP interaction for the payload included in [search query](https://ldapwiki.com/wiki/LDAP%20Query%20Examples), additionally `ldap` flag can be used for complete logging. | ||
|
|
@@ -871,8 +886,8 @@ Currently supported metadata services: | |
|
|
||
| Example: | ||
|
|
||
| * **aws.interact.sh** points to 169.254.169.254 | ||
| * **alibaba.interact.sh** points to 100.100.100.200 | ||
| * **aws.oast.fun** points to 169.254.169.254 | ||
| * **alibaba.oast.fun** points to 100.100.100.200 | ||
|
|
||
| ----- | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,93 @@ | ||
| # This is a reference custom DNS records file | ||
| # | ||
| # Custom DNS records can be specified in two formats: | ||
| # | ||
| # 1. Standard format (supports multiple record types): | ||
| # subdomain: | ||
| # - type: RECORD_TYPE | ||
| # value: "record_value" | ||
| # ttl: 3600 # optional, defaults to server TTL | ||
| # priority: 10 # optional, for MX records only | ||
| # | ||
| # 2. LEGACY FORMAT (Simple key-value, assumes A records): | ||
| # subdomain: "ip_address" | ||
| # | ||
| # Supported record types: A, AAAA, CNAME, MX, TXT, NS | ||
|
|
||
| # The default custom records can be specified using this YAML | ||
| # file using the below declaration. | ||
| aws: "169.254.169.254" | ||
| alibaba: "100.100.100.200" | ||
| localhost: "127.0.0.1" | ||
| oracle: "192.0.0.192" | ||
| # ============================================ | ||
| # STANDARD FORMAT EXAMPLES | ||
| # ============================================ | ||
|
|
||
| # A record example | ||
| api: | ||
| - type: A | ||
| value: "192.0.2.1" | ||
| ttl: 3600 | ||
|
|
||
| # Multiple A records for the same subdomain | ||
| webserver: | ||
| - type: A | ||
| value: "203.0.113.10" | ||
| - type: A | ||
| value: "203.0.113.11" | ||
|
|
||
| # AAAA record (IPv6) | ||
| ipv6: | ||
| - type: AAAA | ||
| value: "2001:db8::1" | ||
|
|
||
| # CNAME record | ||
| cdn: | ||
| - type: CNAME | ||
| value: "example.cdn.net" | ||
|
|
||
| # MX record (mail server) | ||
| mail: | ||
| - type: MX | ||
| value: "mail.example.com" | ||
| priority: 10 | ||
| ttl: 7200 | ||
|
|
||
| # Multiple MX records with different priorities | ||
| mailserver: | ||
| - type: MX | ||
| value: "mail1.example.com" | ||
| priority: 10 | ||
| - type: MX | ||
| value: "mail2.example.com" | ||
| priority: 20 | ||
|
|
||
| # TXT record (useful for SPF, DKIM, verification, etc.) | ||
| spf: | ||
| - type: TXT | ||
| value: "v=spf1 include:_spf.example.com ~all" | ||
|
|
||
| # Multi-level subdomain example (DKIM key) | ||
| something._domainkey: | ||
| - type: TXT | ||
| value: "v=DKIM1; k=rsa; p=MIGfMA0GCS..." | ||
|
|
||
| # NS record (nameserver) | ||
| custom-ns: | ||
| - type: NS | ||
| value: "ns1.example.com" | ||
| - type: NS | ||
| value: "ns2.example.com" | ||
|
|
||
| # Mixed record types for the same subdomain | ||
| multi: | ||
| - type: A | ||
| value: "198.51.100.1" | ||
| - type: AAAA | ||
| value: "2001:db8::2" | ||
| - type: TXT | ||
| value: "v=spf1 mx ~all" | ||
|
|
||
| # ============================================ | ||
| # LEGACY FORMAT EXAMPLES (backwards compatible) | ||
| # ============================================ | ||
| # These simple entries will be interpreted as A records | ||
| # aws: "169.254.169.254" | ||
| # alibaba: "100.100.100.200" | ||
| # localhost: "127.0.0.1" | ||
| # oracle: "192.0.0.192" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix typo: "authencaited" → "authenticated".
The word "authencaited" is misspelled and should be "authenticated".
📝 Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 LanguageTool
[grammar] ~251-~251: Ensure spelling is correct
Context: ..., and supports other self-hosted public/authencaited interactsh servers as well. A hosted i...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents