Catch blind bugs,
that Burp Suite misses.
HTTP, DNS, SMTP and Blind XSS listeners for bug bounty hunters. Generate a callback, paste your payload, get notified when it fires.
Made for hunters working on major bug bounty platforms
Already have a Pro key? Paste it over the trial key below.
Use a burner inbox if you like — email is optional and only alerts you when your listener catches something. Discord & Telegram alerts can be added later from your dashboard.
The first bug you confirm pays for years of this.
- 90-day evidence retention — that blind XSS fires three weeks after you submit. On free it's already gone; on Pro it's still sitting in your feed, timestamped and report-ready.
- Unlimited HTTP, DNS, SMTP & Blind XSS listeners — spin up one per target, no caps, no cooldowns, ever
- Real-time alerts the instant a payload fires — Email, Discord & Telegram, plus a JSON API to wire into your own tooling
- Weaponized file payloads — SVG, PDF, XXE & DTD files with your listener baked in. Drop them in an upload field and catch the callback
- Full forensics per hit — headers, body, source IP, reverse DNS, ASN, geo & timing. Everything a triager needs to mark it valid
- Anonymous by default — no logs, no email required, pay in crypto or PayPal
Instant delivery · anonymous · no auto-renew, no subscription trap
Three steps to a callback
No setup, no server to host, no Burp Pro. Generate, inject, get notified.
Generate a listener
One click gives you a unique subdomain on *.pingback.sh plus ready-made HTTP, DNS, SMTP and Blind XSS payloads.
Drop it in your payload
Paste the callback URL into any suspicious sink — a profile field, a webhook config, an XML parser, a log line.
Get the ping
When the target bites, you get full headers, body, IP, geo and timing — instantly, with email, Discord or Telegram alerts.
This is what you get back
Report-ready evidence, not a screenshot. Every interaction is logged with the detail an H1 / Bugcrowd triager needs.
Built for bug hunters, not devs.
Most request bins are made for developers testing webhooks, mock APIs and integrations. PingBack.sh is made for hunters who need out-of-band evidence for real vulnerability reports.
Webhook / mock API tools
- Debug webhook delivery
- Inspect HTTP requests
- Mock API responses
- Replay integration traffic
- Built for developers and QA teams
PingBack.sh
- Catch HTTP, DNS, SMTP and Blind XSS callbacks
- Generate bug bounty payloads instantly
- Download pre-built SSRF, XXE, SVG and PDF files
- Collect headers, body, IP, ASN, geo and timing evidence
- Built for security researchers and bounty reports
PingBack.sh vs the leaders
RequestBin, Beeceptor and Interactsh are useful tools — but they solve different problems. PingBack.sh focuses on the bug bounty workflow: fast listeners, practical payloads and report-ready OOB evidence.
| Feature | PingBack.sh | RequestBin | Beeceptor | Interactsh |
|---|---|---|---|---|
| HTTP callback capture | Yes | Yes | Yes | Yes |
| DNS callback capture | Yes | No | No | Yes |
| SMTP callbacks | Yes | No | No | Partial |
| Blind XSS payload | Yes | No | No | Manual |
| Ready-made XXE payloads | Yes | No | No | Manual |
| SVG / PDF / PNG payload files | Yes | No | No | No |
| Bug bounty-focused use cases | Yes | No | No | Security |
| Mock API / fake endpoints | No | Basic | Yes | No |
| Request replay / editing | No | Yes | Yes | No |
| No signup required | Yes | Depends | Yes | Yes |
| Main audience | Bug bounty hunters | Developers | Developers / QA | Security testers |
Beeceptor mocks APIs.
Interactsh catches interactions.
PingBack.sh gives bug bounty hunters ready-to-use payloads to prove real-world impact.
What you can detect
Bug classes, organized by the protocol you'll see fire in your dashboard.
- Server-Side Request Forgery (SSRF)
- Cloud metadata exfiltration
- Webhook destination abuse
- OAuth redirect_uri smuggling
- PDF / image renderer SSRF
- CI/CD secrets exfiltration
- log4j / JNDI lookups
- Blind SSRF behind egress firewalls
- SSTI (Server-Side Template Injection)
- Command injection (OOB confirmation)
- XXE data exfiltration
- Admin panel XSS via user input
- Support ticket / CRM injection
- Filename / upload listing XSS
- SVG-based stored XSS
- Password reset email enumeration
- Email verification bypass
- Invitation system abuse
- Webhook event leak
Every request to *.pingback.sh is logged with full headers,
body, source IP, geo and ASN. XSS payloads capture cookies, DOM, localStorage and origin.
DNS queries are captured at the authoritative nameserver — no recursion, no waiting.
Start free. Go Pro the day a callback lands you a bounty.
Free 24h trial to kick the tyres · then $39 / 30 days for unlimited listeners, 90-day evidence retention and instant alerts. Pay in crypto or PayPal — instant, anonymous, no auto-renew.
See Pro pricing →