Visit Apps Ved →

dalfox

open-source XSS vulnerability scanner and parameter analyzer

TLDR

Scan a URL for XSS vulnerabilities
$ dalfox url [https://example.com?q=test]
Scan with custom payloads file
$ dalfox url [https://example.com?q=test] --custom-payload [payloads.txt]
Scan multiple URLs from file
$ dalfox file [urls.txt]
Pipe URLs from another tool
$ cat [urls.txt] | dalfox pipe
Use blind XSS callback
$ dalfox url [https://example.com?q=test] --blind [https://your.xss.ht]
Output results to JSON file
$ dalfox url [https://example.com?q=test] -o [results.json] --format json

SYNOPSIS

dalfox mode [target] [options]

DESCRIPTION

dalfox is a powerful open-source XSS (Cross-Site Scripting) vulnerability scanner and parameter analyzer. It specializes in finding reflected XSS, stored XSS, and DOM-based XSS vulnerabilities through automated testing.The tool performs parameter analysis to identify injection points, then tests with a comprehensive payload database. It supports blind XSS detection using external callback servers and can integrate with other security tools through piped input.dalfox includes features like DOM rendering analysis, WAF detection and evasion, and intelligent payload mutation. It's designed for penetration testers and security researchers conducting authorized security assessments.

PARAMETERS

MODE

Operation mode: url, file, pipe, sxss, server, payload.
TARGET
URL or file containing URLs to scan.
--custom-payload FILE
Use custom payload file.
--blind URL
Blind XSS callback URL.
-o, --output FILE
Output file path.
--format FORMAT
Output format: plain, json, xml.
--cookie STRING
Set cookies for requests.
-H, --header STRING
Add custom header.
--proxy URL
HTTP proxy to use.
-w, --worker N
Number of concurrent workers.
--silence
Suppress all output except results.
--mining-dict
Enable dictionary-based parameter mining.
--mining-dom
Enable DOM-based parameter mining.
--only-custom-payload
Only test custom payloads, skip built-in payloads.
--remote-payloads SOURCE
Use remote payloads (portswigger, payloadbox).
--skip-xss-scanning
Skip XSS scanning, only perform parameter analysis.
--poc-type TYPE
PoC output format (plain, curl, httpie, http-request).
--help
Display help information.

INSTALL

brew install dalfox
nix profile install nixpkgs#dalfox

CAVEATS

Only use on systems you have explicit authorization to test. False positives may occur; verify findings manually. High request rates may trigger rate limiting or bans. Some XSS types require browser-based verification.

HISTORY

dalfox was created by hahwul and released in 2020. The name stands for "Finder Of XSS" with "dal" meaning moon in Korean. It was designed as a fast, flexible alternative to existing XSS scanners, with emphasis on automation and accuracy.

SEE ALSO

nikto(1), sqlmap(1), nuclei(1), httpx(1)