webhook.press Tool

Services ▾
Application Security
Web Application Penetration Testing API Penetration Testing Mobile Application Penetration Testing GraphQL Security Testing Secure Code Review SaaS Penetration Testing E-Commerce Penetration Testing
Network & Infrastructure
External Network Penetration Testing Internal Network Penetration Testing Wireless Network Penetration Testing Firewall & Configuration Review IoT Device Penetration Testing OT / ICS / SCADA Penetration Testing
Cloud & Container
AWS Penetration Testing Azure Penetration Testing GCP Penetration Testing Kubernetes Penetration Testing Cloud Configuration Review Container Security Assessment
Red Team
Red Team Operations Social Engineering Assessment Phishing Simulation Assumed Breach Assessment Ransomware Readiness Assessment
Identity & Access
Active Directory Penetration Testing Entra ID (Azure AD) Security Assessment OAuth, OIDC & SAML SSO Testing
AI & LLM Security
AI Agent Penetration Testing Prompt Injection Testing LLM Jailbreak & Guardrail Testing RAG Pipeline Security Assessment MCP Server & Tool-Chain Security Testing LLM Application Penetration Testing
Compliance
SOC 2 Penetration Testing ISO 27001 Penetration Testing PCI DSS Penetration Testing HIPAA Penetration Testing GDPR Penetration Testing NIS2 & DORA Penetration Testing
Tools ▾
Free tools
Webhook Tester Free Webhook Tester webhook.site Alternative RequestBin Alternative Webhook Debugger

Pentest Pricing Docs Blog Book a pentest

Blog

The Best Free RequestBin Alternative for Security Testing

RequestBin is gone. webhook.press gives live HTTP capture plus DNS-OOB, redirects and payload hosting - Burp Collaborator, free and self-serve.

Detecting Blind XXE with Out-of-Band (OOB) Callbacks

No response body? Blind XXE leaks data out-of-band. Host a DTD, exfiltrate files over HTTP, and switch to DNS when egress is filtered.

How to Test for SSRF Using a Webhook (OOB Guide)

Confirm and exploit SSRF with an out-of-band webhook callback: catch the request, read the source IP, bypass metadata filters, and fall back to DNS.

Get in touch

Tell us what you'd like tested — we'll reply with scope and a fixed quote.