Threadway
Start free
Invited
Claim it

See the callback nobody else shows you.

A reverse tunnel and an out-of-band capture server, on infrastructure you own. Catch the blind SSRF, the XXE, the deferred injection, the moment the target reaches back, attributed to the right test.

Start free See how it works
No card to start Your own subdomain interactsh-compatible
interactions, live x7f2.oob.threadway.cloud
Captures
DNSlookups
HTTP/Srequests
SMTPmail
LDAPand JNDI
TCPconnects

The problem

Blind bugs do not announce themselves.

So you stitch together a tunnel, a public OAST server, and a desktop scanner, and still miss who triggered what.

01

Public OAST gets blocked

Shared callback domains are well known and filtered by the targets you most want to test. Your proof never arrives.

02

Three tools, one workflow

A tunnel here, an interaction server there, a separate inspector. Context lives in three places and none of them talk.

03

No team view, no attribution

On an engagement, a DNS hit coming in is useless if you cannot tell whose payload, which target, which test.

One platform

Tunnel in. Callbacks out. Your domain, your data.

Three capabilities most people buy separately. Here they share one account, one inbox, and one audit trail.

Reverse tunnel

Expose localhost, on a name you control

HTTP, TCP and UDP tunnels with reserved and custom subdomains. Put a password, an IP allowlist or a country block in front of any endpoint, enforced at the edge before traffic reaches you.

  • HTTP / TCP / UDP, reserved and wildcard subdomains
  • Password, IP allowlist and geo rules at the edge
  • Request inspector with replay and HAR export
# start a tunnel to your local app $ threadway http 3000 --subdomain demo ✓ tunnel up https://demo.threadway.cloud → localhost:3000 inspector http://127.0.0.1:4848 # lock it down $ threadway http 3000 --subdomain demo \ --password "reviewers" --allow 203.0.113.0/24
Out-of-band capture

interactsh-compatible, on your own domain

Generate a listener and drop the payload into your test. DNS, HTTP, SMTP and LDAP callbacks land in a single inbox, decrypted, timestamped, and tied to the listener that produced them. Use your own domain so targets do not recognise and filter it.

  • Drop-in for the interactsh client and Nuclei
  • Full per-interaction detail: request, source, time
  • Canary-token tripwires on the same domain
# point any interactsh client at your server $ interactsh-client -server oob.threadway.cloud -token •••• [INF] payload: x7f2k9...oob.threadway.cloud [x7f2k9] DNS (A) from 198.51.100.20 [x7f2k9] HTTP GET / from 203.0.113.9 attributed → engagement: acme-q3 · you
Teams and engagements

Built for a job, not just a session

Group tunnels and listeners into an engagement, share them with your team, and keep every interaction attributed to a person and a target. Fine-grained plans, per-user limits, and an audit trail come standard.

  • Engagements that group tunnels, catchers and findings
  • Per-interaction attribution and exportable audit log
  • Captures stay in your account, not a shared public collector
# engagement: acme-q3 members 4 tunnels 2 active listeners 3 interactions 128 (dns 96 · http 24 · smtp 8) amal 41 interactions you 63 interactions noor 24 interactions

How it works

Proof of a blind bug, in three moves.

1

Spin up a listener

One command, or one click, gives you a unique payload on your own out-of-band domain.

2

Plant the payload

Drop it into the parameter, header, document or template you are testing, manually or via Nuclei.

3

Watch it land

When the target reaches back, the interaction appears in your inbox with full detail and attribution.

Why switch

One tool instead of the stack you run now.

Most testers juggle a free public OAST server, a paid tunnel, and a desktop licence. Here is how that compares.

 
Public OAST
Tunnel SaaS
Threadway
Out-of-band capture
Yes
No
Yes
Your own callback domain
Shared / blocked
No
Yes
Reverse tunnel (HTTP/TCP/UDP)
No
Yes
Yes
Multi-user and attribution
No
Add-on
Yes
Captures private to your account
Shared
No
Yes

For organisations

One plan. Everyone on it.

Buying a licence each and hoping people remember to expense it is not a plan. A Team plan is one agreement, one invoice, and limits set to what your people actually do.

Team plan

Seats you hand out, limits we agree

Tell us how many people and what they need. We price it per seat, you invite them by email, and you can take a seat back the moment somebody moves on.

  • Bandwidth is shared, not divided. One monthly pool across the whole team, so the person having a heavy week is not blocked by a quota nobody else is using.
  • You run the seats. Invite by email, remove somebody in one click. Removing them ends their sessions and closes their live tunnels there and then.
  • Limits are yours to ask for. Reserved subdomains, reserved ports, UDP, OAST and capture retention are all on the quote form, not a support ticket.
  • You see the usage. Who is using what, this month, in one table rather than four invoices you reconcile by hand.
Request a quote
No card to request Billed per seat, monthly Pay by PayPal or card
Leader holds seat 1 6 of 8 filled

Pricing

Start free. Pay when it is real work.

Every plan includes out-of-band capture, the request inspector and the audit trail.

Loading plans

Prices in USD.

Referrals

Bring someone with you

    Credit is earned, never bought. It can only be spent on a Threadway subscription: it has no cash value and cannot be withdrawn, transferred or refunded. Full terms.

    Questions

    Good to know.

    Do I get anything for inviting people? +

    Who is this for? +

    Security testers doing authorized work: bug-bounty hunters, penetration testers, red teams, and CTF organizers, plus developers who need a tunnel with a real request inspector. Use it only against systems you are permitted to test.

    How is this different from interactsh? +

    It speaks the same protocol, so your existing clients and Nuclei work unchanged. The difference is the product around it: callbacks land on your domain rather than a shared one that targets filter, they are stored with full history and attribution, multiple people can share an engagement, and it is a managed account rather than a browser tab backed by local storage.

    Do you store my card details? +

    No. Payments are handled by the payment provider, currently PayPal, and card details go to them, never to us. We store which plan you are on and when it renews, and nothing about how you paid for it.

    Can I cancel anytime? +

    Anytime, from your billing page. You keep access until the end of the period you have paid for, and the free tier is always there to fall back to.

    Point a payload at your own domain today.

    Free to start, no card required. Upgrade when the callbacks start paying for themselves.

    Create your free account