Out-of-band testing · self-hosted
A reverse tunnel and an out-of-band capture server, on infrastructure you own. Catch the blind SSRF, the XXE, the deferred injection — the moment the target reaches back, attributed to the right test.
The problem
So you stitch together a tunnel, a public OAST server, and a desktop scanner — and still miss who triggered what.
Shared callback domains are well-known and filtered by the targets you most want to test. Your proof never arrives.
A tunnel here, an interaction server there, a separate inspector. Context lives in three places and none of them talk.
On an engagement, “a DNS hit came in” is useless if you can’t tell whose payload, which target, which test.
One platform
Three capabilities most people buy separately — here they share one account, one inbox, and one audit trail.
HTTP, TCP and UDP tunnels with reserved and custom subdomains. Put a password, an IP allowlist or a country block in front of any endpoint — enforced at the edge before traffic reaches you.
Generate a listener and drop the payload into your test. DNS, HTTP, SMTP and LDAP callbacks land in a single inbox, decrypted, timestamped, and tied to the listener that produced them. Use your own domain so targets don’t recognise and filter it.
Group tunnels and listeners into an engagement, share them with your team, and keep every interaction attributed to a person and a target. Fine-grained plans, per-user limits, and an audit trail come standard.
How it works
One command (or one click) gives you a unique payload on your own out-of-band domain.
Drop it into the parameter, header, document or template you’re testing — manually or via Nuclei.
When the target reaches back, the interaction appears in your inbox with full detail and attribution.
Why switch
Most testers juggle a free public OAST server, a paid tunnel, and a desktop licence. Here’s how that compares.
Pricing
Prices in USD. Cards handled by Stripe — we never store card numbers.
Questions
Security testers doing authorized work — bug-bounty hunters, penetration testers, red teams, and CTF organizers — plus developers who need a tunnel with a real request inspector. Use it only against systems you’re permitted to test.
It speaks the same protocol, so your existing clients and Nuclei work unchanged. The difference is the product around it: callbacks land on your domain (not a shared one that targets filter), they’re stored with full history and attribution, multiple people can share an engagement, and it’s a managed account rather than a browser tab backed by local storage.
Yes. Run the whole platform on your own infrastructure so no traffic or callback ever leaves your control — the usual reason teams self-host their OAST and collaborator servers. Self-host is part of the Enterprise plan.
No. Payments run through Stripe; card data is tokenised and stored by Stripe, and we only ever see the brand, last four digits and expiry to show you which card is on file.
Anytime, from your billing page. You keep access until the end of the period you’ve paid for, and the free tier is always there to fall back to.
Get started
Free to start, no card required. Upgrade when the callbacks start paying for themselves.
Create your free account