keke.rs

What It Is

Interactsh is an open-source tool designed specifically for detecting out-of-band (OOB) interactions. In security testing, many vulnerabilities—such as Blind XSS, SSRF, and XXE—do not return results directly on the application page, but instead trigger external requests. By providing an interaction server, Interactsh helps security professionals capture these hidden OOB requests and verify whether a vulnerability exists. If you see requests from *.colb.keke.rs in your logs, it means a security researcher is testing your application.

Core Analysis

• Protection type: It is not a traditional defensive product, but rather a vulnerability validation and detection tool focused on capturing out-of-band interactions.
• Deployment model: Supports self-hosted servers, while users can also use public instances such as *.colb.keke.rs.
• Compliance certifications: As an open-source testing tool, it does not have specific compliance certifications.
• Suitable scale: Primarily intended for professional security teams, penetration testers, and bug bounty hunters; best suited to individual or small-scale security testing scenarios.
• Management and alerts: Provides feedback by recording interaction logs sent to specific subdomains. It does not include a proactive alerting mechanism; logs need to be pulled and analyzed manually or via client tools.
• Integration capability: Commonly used as a low-level component together with automated security testing frameworks to enable automated vulnerability validation.

Pricing

Completely open-source and free. Users do not need to pay any licensing fees to self-host the service from source code or use public instances.

Pros and Cons

Its strengths are that it is open-source, free, lightweight, and highly specialized for OOB vulnerability detection. Its drawbacks are that it has a relatively high learning curve for non-security professionals, self-hosting requires some operations capability, and public instances may be blocked by target firewalls.

Who It’s For

Best suited for penetration testing engineers, internal red/blue team security personnel, and bug bounty hunters.

Access from China and Alternatives

• Network/payment: As an open-source project, it generally needs to be deployed by the user, and accessibility depends on the deployment location. The public instance keke.rs has an unknown access status in China and may encounter DNS resolution or network restrictions. No payment is required.
• Alternatives: Burp Suite Collaborator, Ceye.io, and others.