webhook.press docs

webhook.press is a free webhook & out-of-band (OOB) testing tool for pentesters and bug bounty hunters. Catch HTTP requests in real time, host payloads, fire redirects, and log DNS lookups — think Burp Collaborator, self-serve and free.

Quick start

Open webhook.press. You instantly get a unique URL like:

https://webhook.press/<your-token>

Anything that hits that URL — any method, headers, query, body — shows up live in the UI, with the sender’s IP. Point a webhook, an SSRF payload, or a form at it and watch the requests arrive.

Custom responses

Each session lets you set the status code, headers, body and delay of the response your endpoint returns — handy for redirects, fake APIs and timing tests.

OOB arsenal

Every session token unlocks a set of offensive tools at https://webhook.press/<token>/<tool>. They’re tied to your token so the domain can’t be abused as an open redirector. See them all at /<token>/tools.

Redirects

/<token>/r?u=https://evil.tld            # 302 to any URL
/<token>/r?u=http://169.254.169.254/&code=307   # 307 keeps method/body (cloud SSRF)
/<token>/r?u=gopher://127.0.0.1:6379/_INFO       # scheme switch: gopher/dict/file
/<token>/m?u=...     # meta-refresh redirect (client side)
/<token>/j?u=...     # JS location redirect
/<token>/chain?u=...&n=5   # N chained 302s (test follow-redirect depth)

Probes

/<token>/status?code=500    # return any HTTP status
/<token>/delay?s=15         # slow response (timeout / race window)
/<token>/cors              # permissive CORS target for exfil tests
/<token>/echo              # echo the incoming request as JSON

Payload hosting

/<token>/p/<file>   # serve a hosted payload (XSS, XXE DTD, SVG)

DNS-based OOB

For blind vulnerabilities with no outbound HTTP, use a DNS callback:

<anything>.<token>.oob.webhook.press

Any DNS lookup of that name is logged (the query proves the callback even when the response never comes back) — ideal for blind SSRF and RCE.

Typical uses

• SSRF: put your session URL (or a /r redirect) where the server fetches a URL, then watch the callback and its source IP.
• Blind XXE: host an external DTD via /p/ and exfiltrate over HTTP or DNS.
• Open redirect & SSRF filter bypass: chain /r, /m, /j and scheme switches.
• Webhooks & integrations: inspect exactly what a third party sends you.