Learn about self-hosting an interactsh server
Interactsh server runs multiple services and captures all the incoming requests. To host an instance of interactsh-server, you are required to setup:
This will display help for the tool. Here are all the switches it supports.
For this example, we will utilize GoDaddy for domain registration and a DigitalOcean droplet as the server, where a basic $5 droplet efficiently supports a self-hosted Interactsh server. If using different tools, please follow your registrar’s guidelines for creating or updating DNS entries.
https://dcc.godaddy.com/manage/{{domain}}/dns/hosts
ns1
, ns2
with your SERVER_IP
as valuehttps://dns.godaddy.com/{{domain}}/nameservers
ns1.INTERACTSH_DOMAIN
, ns2.INTERACTSH_DOMAIN
Install interactsh-server
on your VPS
Considering domain name setup is completed, run the below command to run interactsh-server
Following is an example of a successful installation and operation of a self-hosted server:
A number of needed flags are configured automatically to run interactsh-server
with default settings. For example, ip
and listen-ip
flags set with the Public IP address of the system when possible.
Multiple domain names can be given in the same way as above to run the same interactsh server across multiple configured domains.
There are more useful capabilities supported by interactsh-server
that are not enabled by default and are intended to be used only by self-hosted servers.
interactsh-server
might require custom ports for services if the default ones are already busy. If this is the case but still default ports are required as part of the payload, it’s possible to configure interactsh-server
behind a reverse proxy, by port-forwarding HTTP/TCP/UDP based services via http/stream
proxy directive (proxy_pass
).
Assuming that interactsh-server
essential services run on the following ports:
The nginx configuration file to forward the traffic would look like the following one:
Index page for http server can be customized while running custom interactsh server using -http-index
flag.
{DOMAIN}
placeholder is also supported in index file to replace with server domain name.
Interactsh http server optionally enables file hosting to help in security testing. This capability can be used with a self-hosted server to serve files for common payloads for XSS, XXE, RCE and other attacks.
To use this feature, -http-directory
flag can be used which accepts diretory as input and files are served under /s/
directory.
Interactsh http server optionally enables responding with dynamic HTTP response by using query parameters. This feature can be enabled by using -dr
or -dynamic-resp
flag.
The following query parameter names are supported - body
, header
, status
and delay
. Multiple header
parameters can be specified to set multiple headers.
Note:
To enable wildcard
interaction for configured Interactsh domain wildcard
flag can be used with implicit authentication protection via the auth
flag if the token
flag is omitted.
The length of the interactsh payload is 33 by default, consisting of 20 (unique correlation-id) + 13 (nonce token), which can be customized using the cidl
and cidn
flags to make shorter when required with self-hosted interacsh server.
Note: It is important and required to use same length on both side (client and server), otherwise co-relation will not work.
The certmagic library is used by default by interactsh server to produce wildcard certificates for requested domain in an automatic way. To use your own SSL certificate with self-hosted interactsh server, cert
and privkey
flag can be used to provider required certificate files.
Note: To utilize all of the functionality of the SSL protocol, a wildcard certificate is mandatory.
As default, Interactsh server support LDAP interaction for the payload included in search query, additionally ldap
flag can be used for complete logging.
FTP support can be enabled with the -ftp
flag and is recommended for self-hosted instances only. The FTP agent simulates a fully-functional FTP server agent with authentication that captures authentications with every file operation. By default, the agent listens on port 21 (this can be changed with the -ftp-port
flag) and lists in read-only mode the content of the OS default temporary directory (customizable with the -ftp-dir
option).
Example of starting the FTP daemon and capturing a login interaction:
The -smb
flag enables the Samba protocol (only for self-hosted instances). The samba protocol uses impacket smbserver
class to simulate a samba daemon share listening on port 445
unless changed by the -smb-port
flag. When enabled, interactsh executes under the hoods the script smb_server.py
. Hence Python3 and impacket dependencies are required.
Example of enabling the samba server:
Responder is wrapped in a docker container exposing various service ports via docker port forwarding. The interactions are retrieved by monitoring the shared log file Responder-Session.log
in the temp folder. To use it on a self-hosted instance, it’s necessary first to build the docker container and tag it as interactsh
(docker daemon must be configured correctly and with port forwarding capabilities):
Then run the service with:
On default settings, the daemon listens on the following ports:
Learn about self-hosting an interactsh server
Interactsh server runs multiple services and captures all the incoming requests. To host an instance of interactsh-server, you are required to setup:
This will display help for the tool. Here are all the switches it supports.
For this example, we will utilize GoDaddy for domain registration and a DigitalOcean droplet as the server, where a basic $5 droplet efficiently supports a self-hosted Interactsh server. If using different tools, please follow your registrar’s guidelines for creating or updating DNS entries.
https://dcc.godaddy.com/manage/{{domain}}/dns/hosts
ns1
, ns2
with your SERVER_IP
as valuehttps://dns.godaddy.com/{{domain}}/nameservers
ns1.INTERACTSH_DOMAIN
, ns2.INTERACTSH_DOMAIN
Install interactsh-server
on your VPS
Considering domain name setup is completed, run the below command to run interactsh-server
Following is an example of a successful installation and operation of a self-hosted server:
A number of needed flags are configured automatically to run interactsh-server
with default settings. For example, ip
and listen-ip
flags set with the Public IP address of the system when possible.
Multiple domain names can be given in the same way as above to run the same interactsh server across multiple configured domains.
There are more useful capabilities supported by interactsh-server
that are not enabled by default and are intended to be used only by self-hosted servers.
interactsh-server
might require custom ports for services if the default ones are already busy. If this is the case but still default ports are required as part of the payload, it’s possible to configure interactsh-server
behind a reverse proxy, by port-forwarding HTTP/TCP/UDP based services via http/stream
proxy directive (proxy_pass
).
Assuming that interactsh-server
essential services run on the following ports:
The nginx configuration file to forward the traffic would look like the following one:
Index page for http server can be customized while running custom interactsh server using -http-index
flag.
{DOMAIN}
placeholder is also supported in index file to replace with server domain name.
Interactsh http server optionally enables file hosting to help in security testing. This capability can be used with a self-hosted server to serve files for common payloads for XSS, XXE, RCE and other attacks.
To use this feature, -http-directory
flag can be used which accepts diretory as input and files are served under /s/
directory.
Interactsh http server optionally enables responding with dynamic HTTP response by using query parameters. This feature can be enabled by using -dr
or -dynamic-resp
flag.
The following query parameter names are supported - body
, header
, status
and delay
. Multiple header
parameters can be specified to set multiple headers.
Note:
To enable wildcard
interaction for configured Interactsh domain wildcard
flag can be used with implicit authentication protection via the auth
flag if the token
flag is omitted.
The length of the interactsh payload is 33 by default, consisting of 20 (unique correlation-id) + 13 (nonce token), which can be customized using the cidl
and cidn
flags to make shorter when required with self-hosted interacsh server.
Note: It is important and required to use same length on both side (client and server), otherwise co-relation will not work.
The certmagic library is used by default by interactsh server to produce wildcard certificates for requested domain in an automatic way. To use your own SSL certificate with self-hosted interactsh server, cert
and privkey
flag can be used to provider required certificate files.
Note: To utilize all of the functionality of the SSL protocol, a wildcard certificate is mandatory.
As default, Interactsh server support LDAP interaction for the payload included in search query, additionally ldap
flag can be used for complete logging.
FTP support can be enabled with the -ftp
flag and is recommended for self-hosted instances only. The FTP agent simulates a fully-functional FTP server agent with authentication that captures authentications with every file operation. By default, the agent listens on port 21 (this can be changed with the -ftp-port
flag) and lists in read-only mode the content of the OS default temporary directory (customizable with the -ftp-dir
option).
Example of starting the FTP daemon and capturing a login interaction:
The -smb
flag enables the Samba protocol (only for self-hosted instances). The samba protocol uses impacket smbserver
class to simulate a samba daemon share listening on port 445
unless changed by the -smb-port
flag. When enabled, interactsh executes under the hoods the script smb_server.py
. Hence Python3 and impacket dependencies are required.
Example of enabling the samba server:
Responder is wrapped in a docker container exposing various service ports via docker port forwarding. The interactions are retrieved by monitoring the shared log file Responder-Session.log
in the temp folder. To use it on a self-hosted instance, it’s necessary first to build the docker container and tag it as interactsh
(docker daemon must be configured correctly and with port forwarding capabilities):
Then run the service with:
On default settings, the daemon listens on the following ports: