Candidate params → OAST canary
Take URL-shaped parameters, swap in an interactsh payload, watch for hits. Do not jump to metadata.
Level: advanced
Tools: gf, qsreplace, interactsh-client, ffuf
Pipeline
cat urls.txt | gf ssrf | qsreplace 'https://{oast}' | httpx -silent