Self-hosted, zero-knowledge OAST
OAST (out-of-band application security testing) confirms blind bugs, like SSRF or blind RCE, by watching for a callback the target makes to a server you control. Crossfyre’s OAST is self-hostable and zero-knowledge: interactions are sealed to a per-scan key, so even the person running the server only ever holds ciphertext.
What is OAST and why do you need it?
Some of the most serious vulnerabilities never show up in the response body. A blind SSRF, a blind RCE, an out-of-band SQL injection, an XXE: the only proof is the target reaching out to an external host. OAST plants a unique hostname in a payload and records whether the target resolves or fetches it. A DNS lookup in particular escapes most egress filters, which makes it the reliable signal.
What does "zero-knowledge" mean here?
Interactions are sealed to a per-scan key before storage, so the OAST server holds only ciphertext. Self-hosting buys you control of the domain, not visibility into the data, which matters when the callbacks could contain sensitive information from a client’s environment. interactsh is open and hosted; self-hosted plus zero-knowledge plus bring-your-own is the difference.
Do I have to run my own server?
No. There is a managed pool (a Pro capability) you can use out of the box, and a bring-your-own endpoint you select per scan if you want to own the domain and infrastructure. Self-hosting OAST yourself is available on every plan, including Free.
Frequently asked
How is this different from Burp Collaborator or interactsh?
Collaborator and interactsh are hosted services. Crossfyre’s OAST is self-hostable and bring-your-own, and it seals interactions to a per-scan key so the operator cannot read them. It is out-of-band confirmation you can run and audit yourself.
Which protocols does it answer?
DNS and HTTP(S) on the standard ports. DNS is the most reliable signal because a lookup escapes most egress filtering.