Out-of-band testing · self-hosted

See the callback nobody else shows you.

A reverse tunnel and an out-of-band capture server, on infrastructure you own. Catch the blind SSRF, the XXE, the deferred injection — the moment the target reaches back, attributed to the right test.

No card to start Self-host or hosted interactsh-compatible
interactions — live x7f2.oob.threadway.cloud
Captures & correlates
DNS lookups HTTP/S requests SMTP mail LDAP / JNDI TCP connects

The problem

Blind bugs don’t announce themselves.

So you stitch together a tunnel, a public OAST server, and a desktop scanner — and still miss who triggered what.

01

Public OAST gets blocked

Shared callback domains are well-known and filtered by the targets you most want to test. Your proof never arrives.

02

Three tools, one workflow

A tunnel here, an interaction server there, a separate inspector. Context lives in three places and none of them talk.

03

No team view, no attribution

On an engagement, “a DNS hit came in” is useless if you can’t tell whose payload, which target, which test.

One platform

Tunnel in. Callbacks out. Your domain, your data.

Three capabilities most people buy separately — here they share one account, one inbox, and one audit trail.

Reverse tunnel

Expose localhost, on a name you control

HTTP, TCP and UDP tunnels with reserved and custom subdomains. Put a password, an IP allowlist or a country block in front of any endpoint — enforced at the edge before traffic reaches you.

  • HTTP / TCP / UDP, reserved + wildcard subdomains
  • Password, IP allowlist and geo rules at the edge
  • Request inspector with replay and HAR export
# start a tunnel to your local app $ threadway http 3000 --subdomain demo tunnel up https://demo.threadway.cloud → localhost:3000 inspector http://127.0.0.1:4848 # lock it down $ threadway http 3000 --subdomain demo \ --password "reviewers" --allow 203.0.113.0/24
Out-of-band capture (OAST)

interactsh-compatible, on your own domain

Generate a listener and drop the payload into your test. DNS, HTTP, SMTP and LDAP callbacks land in a single inbox, decrypted, timestamped, and tied to the listener that produced them. Use your own domain so targets don’t recognise and filter it.

  • Drop-in for the interactsh client and Nuclei
  • Full per-interaction detail — request, source, time
  • Canary-token tripwires on the same domain
# point any interactsh client at your server $ interactsh-client -server oob.threadway.cloud -token •••• [INF] payload: x7f2k9...oob.threadway.cloud [x7f2k9] DNS (A) ← 198.51.100.20 [x7f2k9] HTTP GET / ← 203.0.113.9 attributed → engagement: acme-q3 · you
Teams & engagements

Built for a job, not just a session

Group tunnels and listeners into an engagement, share them with your team, and keep every interaction attributed to a person and a target. Fine-grained plans, per-user limits, and an audit trail come standard.

  • Engagements that group tunnels, catchers and findings
  • Per-interaction attribution and exportable audit log
  • Self-host the whole thing — nothing leaves your box
# engagement: acme-q3 members 4 tunnels 2 active listeners 3 interactions 128 (dns 96 · http 24 · smtp 8) amal 41 interactions you 63 interactions noor 24 interactions

How it works

Proof of a blind bug, in three moves.

1

Spin up a listener

One command (or one click) gives you a unique payload on your own out-of-band domain.

2

Plant the payload

Drop it into the parameter, header, document or template you’re testing — manually or via Nuclei.

3

Watch it land

When the target reaches back, the interaction appears in your inbox with full detail and attribution.

Why switch

One tool instead of the stack you run now.

Most testers juggle a free public OAST server, a paid tunnel, and a desktop licence. Here’s how that compares.

 
Public OAST
Tunnel SaaS
Threadway
Out-of-band capture
Yes
Yes
Your own callback domain
Shared / blocked
Yes
Reverse tunnel (HTTP/TCP/UDP)
Yes
Yes
Multi-user + attribution
Add-on
Yes
Self-hostable
Manual
Yes

Pricing

Start free. Pay when it’s real work.

2 months free on annual
Free
Kick the tires on a side project.
$0
Start free
  • 1 tunnel · 1 OAST listener
  • Random subdomains, 24h retention
  • No interstitial warning page
  • Community support
Most popular
Pro
For solo hunters and builders.
$10/mo
Start Pro
  • Reserved + custom subdomains
  • 1 custom callback domain
  • 30-day retention · HAR + replay
  • Chat / Slack notifications
Team
For pentest shops and CTF crews.
$30/user/mo
Start Team
  • Everything in Pro, per seat
  • Workspaces, roles, engagement sharing
  • API keys · audit export
  • Priority support
Enterprise
Self-hosted or white-label.
Custom
Talk to us
  • SSO / SAML, unlimited seats
  • Run it on your own infrastructure
  • SLA + dedicated support

Prices in USD. Cards handled by Stripe — we never store card numbers.

Questions

Good to know.

Who is this for? +

Security testers doing authorized work — bug-bounty hunters, penetration testers, red teams, and CTF organizers — plus developers who need a tunnel with a real request inspector. Use it only against systems you’re permitted to test.

How is this different from interactsh? +

It speaks the same protocol, so your existing clients and Nuclei work unchanged. The difference is the product around it: callbacks land on your domain (not a shared one that targets filter), they’re stored with full history and attribution, multiple people can share an engagement, and it’s a managed account rather than a browser tab backed by local storage.

Can I self-host it? +

Yes. Run the whole platform on your own infrastructure so no traffic or callback ever leaves your control — the usual reason teams self-host their OAST and collaborator servers. Self-host is part of the Enterprise plan.

Do you store my card details? +

No. Payments run through Stripe; card data is tokenised and stored by Stripe, and we only ever see the brand, last four digits and expiry to show you which card is on file.

Can I cancel anytime? +

Anytime, from your billing page. You keep access until the end of the period you’ve paid for, and the free tier is always there to fall back to.

Get started

Point a payload at your own domain today.

Free to start, no card required. Upgrade when the callbacks start paying for themselves.

Create your free account