Skip to main content
Every Aquila user gets one out-of-band payload host. It records DNS lookups, HTTP and HTTPS requests, and SMTP mail. Point blind payloads at it, and Aquila tells you when something calls home. The capture engine is a self-hosted interactsh server, run by Aquila.

​
Your payload host

GET /api/oob/endpoint returns your payload host:
hostname is the payload host: one random 33-character label under the OOB domain. The label is the correlation unit, so the host itself carries your key. Any request to it records to your account, with no separate payload string to assemble.
  • identifier — the 33-character label: a 20-character correlation key plus a 13-character nonce.
  • domain — the OOB domain the label sits under.
  • dnsProvisioned — whether the DNS delegation for your hostname is live. A false value self-heals on your next sign-in.
  • correlationId — the 20-character correlation key inside the label.
  • reversedIdentifier — legacy display material. Payloads never use it.
Every account holds exactly one label, and it is random. POST /api/oob/subdomain/regenerate draws a fresh one. DELETE /api/oob/subdomain removes the host. Use the hostname as-is. Hits on the bare domain record nothing, because it carries no key.

​
Build payloads

Put a label in every payload, so each callback identifies the test that fired it. The label rides the path or the mailbox, never the hostname:
  • HTTP — the label rides the path: http://<hostname>/ssrf01/.
  • HTTPS — the same URL over TLS.
  • SMTP — the label is the mailbox local part: ssrf01@<hostname>.
  • DNS — any lookup of your hostname records. DNS takes no label. The lookup itself is the proof.
The dashboard Payloads menu and the hackbot oob_tool build labeled payloads for you, and pair each label with the scan that minted it.

​
Supported protocols

  • DNS — any query type (A, MX, TXT, and more) for your hostname.
  • HTTP — the full request: method, path, headers, and body.
  • HTTPS — the same requests over TLS.
  • SMTP — mail to your hostname: sender, recipient, and message.
Every hit records the protocol, the source IP, and the time. HTTP and HTTPS hits also carry the raw request and the response the server sent.

​
Read interactions

GET /api/oob/interactions lists the recorded hits, newest first: The correlationId filter takes the label you placed in the payload, not the key inside your hostname.

​
Attribute hits to a test

GET /api/oob/correlations lists your live label registrations: the pairing of a payload label with the scan or lead that minted it.
  • POST /api/oob/correlations registers one. Send correlationId (the label), and optionally scanId, leadId, and note.
  • DELETE /api/oob/correlations/{correlationId} drops one.

​
Clean up

  • DELETE /api/oob/interactions/{id} — delete one hit.
  • DELETE /api/oob/interactions?correlationId=... — delete a whole label group. Omit the parameter to delete all your hits.
The dashboard OOB page shows the same data with a live view.