Free OAST and webhooks tools

OAST (Out-of-Band Application Security Testing)

OAST is a security testing technique that makes the target server send an external request to you (the attacker). You monitor your service to see if that request happens.

Example types of requests:

DNS,HTTP,SMTP,ect ...

Typical services you use to catch these requests:

interact.sh Burp Collaborator ...

Free OAST, Webhook and Tunneling Tools#

A curated list of free and useful services for pentesters, bug bounty hunters and lab practice.

Out-of-Band (OAST) Services#

These services let you detect Blind OS Command Injection, SSRF, XXE, etc. by receiving DNS/HTTP requests triggered by your payloads.

Interact.sh#

• URL: https://github.com/projectdiscovery/interactsh (opens in a new tab)
• Free and open-source OAST server.
• Supports DNS, HTTP, SMTP interactions.
• Can be self-hosted or use public instances.
• Very popular in Bug Bounty and labs.

dnslog.cn#

• URL: http://dnslog.cn (opens in a new tab)
• Very simple free DNS logging service.
• Easy to use, no login required.
• Great for quick DNS-based OAST tests.

Burp Collaborator (Paid in Pro, but alternatives exist)#

• Burp Suite Professional includes Collaborator.
• Self-hosted open-source Burp Collaborator Server can be set up for free.
• For Community Edition users: use interact.sh instead.

Webhooks / HTTP Request Bins#

Useful for testing Webhook integrations, SSRF, blind HTTP callbacks.

Pipedream RequestBin#

• URL: https://pipedream.com/requestbin (opens in a new tab)
• Free, easy to use.
• Create bins to receive and inspect HTTP requests.
• Great for SSRF testing and webhook debugging.

Beeceptor#

• URL: https://beeceptor.com/ (opens in a new tab)
• Free tier available.
• Create custom endpoints.
• Inspect requests and responses.
• Useful for webhook testing and SSRF proof of concepts.

webhook.site#

• URL: https://webhook.site (opens in a new tab)
• Free with optional pro features.
• Get a unique URL to capture all HTTP requests.
• Can customize responses.
• Supports sharing bins with teams.

Tunneling / Port Forwarding#

Expose local services or labs to the internet for testing payloads, receiving callbacks, etc.

DMZ + Port Forwarding#

• Typically used in lab or home network setups.
• DMZ: forwards all incoming traffic to a specific internal IP.
• Port forwarding: maps specific ports from your router to internal devices.
• Use carefully, as it can expose internal services.

Alternative modern tools:

• ngrok (free tier available)
• LocalTunnel
• Cloudflare Tunnel

Notes#

Always use these tools responsibly.
Check if targets allow testing before using out-of-band payloads.
Ideal for pentesting labs (PortSwigger, TryHackMe, HackTheBox, etc.)

Made by Anas Education – Pentest Notes.