Documentation

Everything below is the shipped behaviour of the client and panel. If a command here does not work, that is a bug worth reporting.

1. Install the client

Download a build for your platform from the download page. The client verifies TLS by default and refuses an update without a published checksum from this panel.

Run it once with no arguments to open the local control panel, or go straight to the command line. Save your server so you do not repeat it:

threadway --server vps.example.com --save

2. Your first tunnel

Expose something listening locally. The first run asks you to authenticate and caches a token; --login forces that again and --logout clears it.

threadway http 3000        # a local web app
threadway tcp 22           # a raw TCP service
threadway udp 5353         # UDP, where your plan allows it

Add --tls to encrypt the control channel between the client and the server. The public visitor's leg is HTTPS either way.

3. Names and ports

An HTTP tunnel gets a subdomain. Ask for a random one, or a specific one if your plan allows reserving names:

threadway http 3000 --subdomain           # random name
threadway http 3000 --subdomain myapp     # a name you have reserved

TCP tunnels get a public port. --public-port asks for a specific one, within whatever range your plan permits.

4. Capturing callbacks

A webhook endpoint (a "catcher") receives requests and keeps them so you can read the headers, body and source address afterwards. Manage them from the panel, or from the client:

threadway webhook list
threadway webhook create
threadway webhook watch     # stream requests as they arrive
threadway webhook rm <id>

Every capture records the time, method, path, headers, body and remote address. That is what turns "the payload probably fired" into something you can put in a report.

5. Out-of-band testing

Blind bugs do not return output. Point a payload at your OAST hostname and the DNS, HTTP, SMTP or LDAP interaction is recorded against your account. The endpoints are interactsh-compatible, so the interactsh client and Nuclei work against them with your personal token. Your token and hostnames are on the OAST page in the panel, which needs you to be signed in.

6. Several tunnels at once

Describe them in a file and bring them all up together:

threadway --config tunnels.json

Useful flags while a tunnel is running: --inspect opens a local request inspector, --status-line prints a live one-line summary, --reconnect brings the tunnel back after a drop, and --ttl closes it automatically after a set duration.

7. Command reference

Command	What it does
threadway tcp|http|udp <port>	Open a tunnel to a local port
threadway --status	List your active tunnels
threadway --config FILE	Bring up several tunnels at once
threadway gui	Open the local web control panel
threadway webhook …	List, create, watch or delete capture endpoints
threadway --login / --logout	Authenticate, or clear the cached token
threadway --save	Persist server, port and TLS settings as defaults
threadway --version	Print the client version

Full flag list: threadway --help. It is the authoritative reference, since it ships with the binary you are running.

8. Limits

Concurrent tunnels, monthly data, capture endpoints, retention and reservable names are set by your plan; the current numbers are on the pricing page and your own usage against them is on your billing page. When you hit one, the error says which limit and what your plan allows.

Still stuck?

The FAQ covers the questions that come up most. Anything else: get in touch.