Collaborator for Out-of-Band Testing
Generate unique callback URLs that catch DNS and HTTP interactions, for finding blind SSRF, XXE, injection and similar bugs. The AI can use it on its own, and you can use it from the desktop app, the web console or your XHack link.
Catch the Bugs That Never Show on the Page
Some vulnerabilities leave no trace in the response. The only sign is that the target quietly reaches out to another server. Collaborator gives you unique callback URLs and catches those DNS and HTTP interactions, so blind SSRF, XXE, injection and similar bugs stop being invisible.
Simple to Use
- Click Collaborator in the toolbar.
- Create a new payload and copy its URL.
- Put it where you are testing: a parameter, a header, an XML entity.
- Hits appear in the list automatically, or click Poll now to check straight away.
Select a hit to see the raw request, copy it, or send it to Repeater to keep working. Choose the callback server in Settings, and clear the list whenever you like.
The AI Uses It Too
Ask the AI to test for blind SSRF or other out-of-band issues and it uses Collaborator by itself, from placing the payload to reading the hits.
Wherever You Work
Collaborator works in the desktop app, in the web console, and through your private XHack link, so you can watch for callbacks from any screen.
Learn More
Try it on your own stack
Run this against a target you own and judge it on what it finds, not on a description.
Try XHack AIQuestions about this?
You get a researcher on the call, not a sales engineer reading the same page back to you.
Contact supportMore in XHack AI
Capabilities that sit alongside this one.