# Dalfox

> Use for tightly scoped XSS validation during authorized web assessments. Trigger on reflected or stored XSS candidate triage, payload verification, and repeatable retest of confirmed cross-site scripting weaknesses.

- Skill: `timsonner/dalfox` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/dalfox`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/dalfox/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/dalfox

---


# Dalfox

## Purpose

Use this skill for controlled XSS validation after manual or proxy-based triage identifies a credible candidate.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to validate a likely reflected or stored XSS issue.
- Need a repeatable retest for confirmed XSS.
- Need focused payload handling rather than broad scanning.

## Avoid When

- No credible XSS candidate exists.
- Payload-driven validation would exceed the approved impact level.

## Inputs

- Approved URL, parameter, or request path
- Auth context and payload constraints
- Evidence requirements for proof of impact

## Procedure

1. Start from a manually triaged candidate.
2. Keep payloads limited to the minimum needed for confirmation.
3. Stop once the issue is confirmed to the approved standard.
4. Record the exact parameter and payload path used.
5. Preserve the proof path for retest.

## Command Syntax

Replace sample targets with approved in-scope URLs.

```bash
# XSS scan against a GET parameter
dalfox url 'https://portal.contoso.com/search?q=test'

# Scan with custom header (authenticated)
dalfox url 'https://portal.contoso.com/search?q=test' -H "Authorization: Bearer <token>"

# Scan a list of URLs from file
dalfox file contoso-params.txt

# Blind XSS with out-of-band callback
dalfox url 'https://portal.contoso.com/search?q=test' --blind https://oob.contoso-test.com

# Pipe URLs from a recon pipeline
echo 'https://portal.contoso.com/search?q=test' | dalfox pipe

# Skip DOM analysis
dalfox url 'https://portal.contoso.com/search?q=test' --skip-dom

# Output to file
dalfox url 'https://portal.contoso.com/search?q=test' -o contoso-xss.txt
```

## Evidence to Capture

- Exact parameter and payload path that confirmed XSS
- Preconditions and context required for reproduction
- Minimal proof needed for remediation

## Safety Boundaries

- Use only focused payloads against approved targets.
- Avoid broader payload spraying or unsafe browser-impact tests unless explicitly approved.