Building a Burp Collaborator Clone with Interactsh in 15 Minutes

Prerequisites

• A Linux VPS with a public IP (1GB RAM minimum)
• A domain name with DNS access
• Basic familiarity with SSH and command line
• Go 1.19+ installed (we'll cover this)

What is Interactsh?

Interactsh is an open-source alternative to Burp Collaborator that detects out-of-band interactions (DNS, HTTP, SMTP). It's essential for blind SSRF, XXE, and log4j-style vulnerabilities where you don't see immediate responses.

Step 1: Prepare Your Domain

First, configure DNS for your domain. You need NS records pointing to your server.

In your DNS provider, add these records (replace YOUR_IP and your-domain.com):

code copy
ns1.your-domain.com.  A      YOUR_IP
ns2.your-domain.com.  A      YOUR_IP
interact.your-domain.com. NS  ns1.your-domain.com.
interact.your-domain.com. NS  ns2.your-domain.com.

Wait 5-10 minutes for DNS propagation.

Step 2: Install Interactsh Server

SSH into your VPS and install Go if needed:

bash copy
wget https://go.dev/dl/go1.21.5.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.5.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc

Install Interactsh:

bash copy
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest
sudo mv ~/go/bin/interactsh-server /usr/local/bin/

Step 3: Launch the Server

Create a directory for storing interaction logs:

bash copy
mkdir ~/interactsh-data
cd ~/interactsh-data

Start the server (use screen or tmux for persistence):

bash copy
sudo interactsh-server \
  -domain interact.your-domain.com \
  -ip YOUR_IP \
  -listen-ip 0.0.0.0 \
  -dns-port 53 \
  -http-port 80 \
  -https-port 443 \
  -smtp-port 25

You should see:

code copy
[INF] Listening on TCP 0.0.0.0:80
[INF] Listening on UDP 0.0.0.0:53

Step 4: Test Your Server

Install the client on your local machine:

bash copy
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

Generate a unique URL and listen for interactions:

bash copy
interactsh-client -server https://interact.your-domain.com

You'll get a unique subdomain like ckh4k2j0vtc00000l8gg.interact.your-domain.com.

Trigger a DNS lookup from another terminal:

bash copy
curl http://ckh4k2j0vtc00000l8gg.interact.your-domain.com
nslookup test.ckh4k2j0vtc00000l8gg.interact.your-domain.com

The client should display the interactions immediately:

code copy
[DNS] Received DNS request from 203.0.113.45
[HTTP] Received HTTP request from 203.0.113.45

Step 5: Make It Persistent with systemd

Create a service file:

bash copy
sudo nano /etc/systemd/system/interactsh.service

Paste this configuration:

ini copy
[Unit]
Description=Interactsh Server
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/root/interactsh-data
ExecStart=/usr/local/bin/interactsh-server -domain interact.your-domain.com -ip YOUR_IP
Restart=always

[Install]
WantedBy=multi-user.target

Enable and start:

bash copy
sudo systemctl daemon-reload
sudo systemctl enable interactsh
sudo systemctl start interactsh
sudo systemctl status interactsh

Step 6: Use It in Testing

Now integrate it into your workflow. For SSRF testing:

bash copy
# Generate a unique URL
interactsh-client -server https://interact.your-domain.com -n test-payload

# Use the URL in your exploit
curl "https://vulnerable-app.com/fetch?url=http://xyz123.interact.your-domain.com/ssrf-test"

For blind XXE:

xml copy
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://abc456.interact.your-domain.com/xxe"> ]>
<root>&xxe;</root>

Where to Go Next

• Add HTTPS with Let's Encrypt using certbot
• Explore Interactsh's authentication features for team use
• Integrate with Nuclei templates using -interactsh-server flag
• Check /var/log/interactsh/ for historical interaction data
• Read the docs at https://github.com/projectdiscovery/interactsh

You now have enterprise-grade out-of-band detection infrastructure at zero cost!