Dalfox
| File:Dalfox.png | |
| Original author(s) | HyunHwan Lee (hahwul).[1] |
|---|---|
| Repository | github |
| Written in | Go |
| Engine | |
| License | MIT License |
| Website | dalfox |
Search Dalfox on Amazon.
Dalfox is an open-source tool for detecting XSS (Cross-Site Scripting) vulnerabilities, written in Go, and released under the MIT license. It is designed with a focus on automation[2][3].
When used as a command-line tool, Dalfox analyzes parameters and scans for reflected, stored, and DOM-based XSS vulnerabilities. It can process inputs from single URLs, file-based lists, or pipeline data, and uses a built-in headless browser capability to verify DOM-based XSS. The tool also offers a REST-API for server-based operation and integration into automated workflows, and can be integrated at the source code level as a Go package[4], and is available as a GitHub Action[5].
Features
- XSS Detection
- Parameter Mining
- WAF Detection and Evasion
- Static Analysis (Security header mis-configurations)
- Bulk Scanning
- Scan using Custom Payloads
- Payload Generation
Modes
Dalfox has six modes[6] for XSS Scanning.
- URL: Scans a single target URL for XSS vulnerabilities.
- File: Scans multiple targets from a file list or raw data input.
- Pipe: Processes targets via pipeline input from other tools.
- SXSS: Tests for stored XSS vulnerabilities in web applications.
- Payload: Generates and enumerates XSS payloads for testing.
- Server: Runs DalFox as an API server for remote control.
References
- ↑ "About". HAHWUL.
- ↑ Intigriti (2021-09-14). Find XSS the easy way! Dalfox - Hacker Tools. Retrieved 2025-02-21 – via YouTube.
- ↑ "How to Find XSS". HackerOne. 2024-06-25. Retrieved 2025-02-21.
- ↑ "lib package - github.com/hahwul/dalfox/v2/lib - Go Packages". pkg.go.dev. Retrieved 2025-02-21.
- ↑ "XSS Scan with Dalfox - GitHub Marketplace". GitHub. 2025. Retrieved 2025-02-21.
- ↑ "Usage". Dalfox. Retrieved 2025-02-21.
This article "Dalfox" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Dalfox. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
