ENKO

Hunt every XSS
before it hunts you.

Finds reflected, stored, and DOM-based XSS in every parameter, then checks each hit in the parsed HTML and JavaScript.

Get started Star on GitHub
6 Scan Modes
AST DOM Verification
MCP AI Ready
OSS MIT Licensed

One command, a verified finding

Point Dalfox at a target. It finds the parameters, probes each context, injects payloads, and checks the hit in the parsed DOM before it reports it.

dalfox · scan
$dalfox scan https://xss-game.appspot.com/level1/frame
6:42PM INF start scan to https://xss-game.appspot.com/level1/frame
6:42PM INF found reflected 1 params
└── query valid_specials="/\'{`<>"();=|}[.:]+,$-" invalid_specials=""
6:42PM WRN XSS found 1 XSS
[POC][V][GET][inHTML] ...?query=%3Csvg%20onload%3Dalert%281%29%20class%3Ddlx444fc070%3E
├── Issue: XSS payload DOM object identified
├── Payload: <svg onload=alert(1) class=dlx444fc070>
└── L13: …results were found for <b><svg onload=alert(1) class=dlx444fc070></b>
6:42PM INF scan completed in 3.482 seconds
  • Homebrew
  • Snap
  • Arch (AUR)
  • Chocolatey
  • Nix
  • Cargo
$ brew install dalfox

// Capabilities

One scanner, the whole XSS workflow

Run it against one URL or a whole pipeline: CLI, file batch, pipe, server, or MCP. The same engine runs underneath each one, and every finding is graded by the evidence behind it.

Deep XSS discovery

Reflected, Stored, and DOM-based XSS with payload optimization. DOM verification (HTML parser plus a JavaScript AST) separates a reflection that executes from one that only echoes back.

reflected stored dom ast-verify

Parameter intelligence

Mining, static analysis, pre-encoding detection, and per-character probes tell Dalfox where each parameter lands and which characters survive.

WAF aware

Fingerprints common WAFs and mutates payloads with encoding, case changes, and whitespace and entity tricks to get past them.

Built for pipelines

Pipe, file-batch, and server modes fit into CI/CD. Chain Dalfox after your proxy, crawler, or recon tools.

REST API & MCP

Run Dalfox as a long-lived server with REST control, or expose it as an MCP tool to agents and IDEs.

Reports you can ship

Pick the output your workflow reads, from terse CLI lines to SARIF for GitHub code scanning.

JSON JSONL Markdown SARIF TOML Plain

// Modes

Six ways to run Dalfox

Pick the shape that fits your target. Every mode shares the same discovery and verification engine.

$dalfox scan https://target.app

Scan a single URL. Dalfox mines parameters, probes each context, and checks every hit in the parsed response.

$dalfox scan urls.txt

Scan a list of targets from a file, one URL per line, into one report.

$cat urls.txt | dalfox scan

Read targets from stdin, so Dalfox sits at the end of your crawler or recon pipeline.

$dalfox scan https://app/post --sxss --sxss-url https://app/feed

Inject on one endpoint, then check the page where the stored payload shows up.

$dalfox server

Run Dalfox as a long-lived REST API for async scan jobs, integrations, and dashboards.

$dalfox mcp

Expose Dalfox as MCP tools so agents and IDEs can run scans for you.

From install to verified finding in three steps

Dalfox is a single binary. Install it and run it, with nothing else to set up first.

Install

Install with Homebrew, Snap, the AUR, Chocolatey, Nix, Docker, cargo, or a prebuilt binary. There is no runtime to manage.

brew install dalfox

Point at a target

Give it a URL or a file, or pipe in a crawl. Dalfox mines parameters and probes each context.

dalfox scan https://target.app

Ship the findings

Export to SARIF, JSON, or Markdown for CI, tickets, or code scanning. Each finding says how strong its evidence is.

dalfox scan urls.txt -f sarif -o report.sarif

Built in the open, by hunters everywhere

Dalfox is shaped by the people who run it. Open an issue, send a pull request, or share payloads with the community.

Contributing guide Browse open issues →

Thanks to our contributors

Ready to hunt?

Read the docs, star the repo, or drop Dalfox into your next recon loop.

Get started CLI reference
ESC