The Best Free RequestBin Alternative for Security Testing

RequestBin was the go-to “inspect an HTTP request” tool for years. The public instance is gone, the hosted versions are limited, and self-hosting the old code is a chore. If you test for a living, here’s what to use instead — and why webhook.press is built for security work, not just debugging webhooks.

What you actually need

A good RequestBin alternative should:

• Give you a unique URL instantly, no signup.
• Show requests live with full headers, body and the real source IP.
• Let you control the response (status, headers, body, delay).
• Do more than HTTP — DNS callbacks, redirects, payload hosting — for out-of-band testing.

Why webhook.press

webhook.press covers the basics — open it, get a URL, watch requests arrive — and adds the offensive tooling security testers reach for:

• Redirects for open-redirect and SSRF filter bypass: /<token>/r?u=...
• DNS-OOB for blind SSRF/RCE: <token>.oob.webhook.press
• Payload hosting for XSS and XXE DTDs: /<token>/p/<file>
• CORS, echo, delay and status helpers for edge-case tests.
• Valid HTTPS so callbacks work against strict clients.

It’s the Burp Collaborator experience without needing Burp Pro — free and self-serve.

Quick comparison

RequestBin        webhook.press
--------------    -------------
HTTP capture      HTTP capture (live, real IP)
custom response   custom response
—                 DNS-based OOB
—                 redirects / SSRF bypass
—                 payload hosting
—                 valid HTTPS callbacks

Try it

No account, no wait: open the tool, grab your URL, and point a webhook or SSRF payload at it. When you find something worth chasing, that’s where a real pentest comes in.