timsonner Dalfox
Purpose
Use this skill for controlled XSS validation after manual or proxy-based triage identifies a credible candidate.
Phase Fit
- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure
Use When
- Need to validate a likely reflected or stored XSS issue.
- Need a repeatable retest for confirmed XSS.
- Need focused payload handling rather than broad scanning.
Avoid When
- No credible XSS candidate exists.
- Payload-driven validation would exceed the approved impact level.
Inputs
- Approved URL, parameter, or request path
- Auth context and payload constraints
- Evidence requirements for proof of impact
Procedure
- Start from a manually triaged candidate.
- Keep payloads limited to the minimum needed for confirmation.
- Stop once the issue is confirmed to the approved standard.
- Record the exact parameter and payload path used.
- Preserve the proof path for retest.
Command Syntax
Replace sample targets with approved in-scope URLs.
# XSS scan against a GET parameter
dalfox url 'https://portal.contoso.com/search?q=test'
# Scan with custom header (authenticated)
dalfox url 'https://portal.contoso.com/search?q=test' -H "Authorization: Bearer <token>"
# Scan a list of URLs from file
dalfox file contoso-params.txt
# Blind XSS with out-of-band callback
dalfox url 'https://portal.contoso.com/search?q=test' --blind https://oob.contoso-test.com
# Pipe URLs from a recon pipeline
echo 'https://portal.contoso.com/search?q=test' | dalfox pipe
# Skip DOM analysis
dalfox url 'https://portal.contoso.com/search?q=test' --skip-dom
# Output to file
dalfox url 'https://portal.contoso.com/search?q=test' -o contoso-xss.txt
Evidence to Capture
- Exact parameter and payload path that confirmed XSS
- Preconditions and context required for reproduction
- Minimal proof needed for remediation
Safety Boundaries
- Use only focused payloads against approved targets.
- Avoid broader payload spraying or unsafe browser-impact tests unless explicitly approved.