oob

Documentation

Overview

Package oob is an out-of-band interaction catcher for blind-vulnerability testing (blind SSRF / XXE / SQLi / RCE). It mints unique tokens, records any inbound HTTP request whose path carries one (/oob/<token>/…), and lets the UI poll the captured interactions.

Reachability is the operator's responsibility: the catcher only sees callbacks that actually reach the bound interface. For local testing the control origin works; for a real target, bind externally (or tunnel) and set the base URL so payloads point at a host the target can resolve and reach. (This is the same constraint any collaborator has — we just don't ship a public server.)

Index

• func TokenFromPath(p string) string
• type Catcher
  • func New() *Catcher
  • func (c *Catcher) Clear()
  • func (c *Catcher) Count() int
  • func (c *Catcher) List() []Interaction
  • func (c *Catcher) Record(r *http.Request, bodyPreview string)
  • func (c *Catcher) SetNotifier(fn func())
  • func (c *Catcher) Token() string
• type Interaction

Functions

func TokenFromPath

func TokenFromPath(p string) string

TokenFromPath extracts the token from a /oob/<token>[/...] request path, or "".

Types

type Catcher

type Catcher struct {
	// contains filtered or unexported fields
}

Catcher records OOB interactions in memory.

func New

func New() *Catcher

New returns an empty Catcher.

func (*Catcher) Clear

func (c *Catcher) Clear()

Clear drops all recorded interactions.

func (*Catcher) Count

func (c *Catcher) Count() int

Count returns how many interactions are stored.

func (*Catcher) List

func (c *Catcher) List() []Interaction

List returns the recorded interactions, newest first.

func (*Catcher) Record

func (c *Catcher) Record(r *http.Request, bodyPreview string)

Record stores an interaction for the request (token taken from its path). bodyPreview should be a short, already-truncated snippet (may be empty).

func (*Catcher) SetNotifier

func (c *Catcher) SetNotifier(fn func())

SetNotifier registers a callback fired when a new interaction is recorded.

func (*Catcher) Token

func (c *Catcher) Token() string

Token mints a fresh random token to embed in an OOB payload URL.

type Interaction

type Interaction struct {
	ID         int64  `json:"id"`
	Token      string `json:"token"`
	Method     string `json:"method"`
	Path       string `json:"path"`
	RemoteAddr string `json:"remoteAddr"`
	Host       string `json:"host"`
	UserAgent  string `json:"userAgent"`
	Query      string `json:"query"`
	BodyPrev   string `json:"bodyPreview"`
	TS         int64  `json:"ts"` // unix millis
}

Interaction is one recorded inbound hit.