Getting Started

This section takes you from zero to a verified XSS finding in about ten minutes.

What is Dalfox?

Dalfox is an open-source XSS scanner and automation utility. Give it a URL, a file of URLs, or a piped crawl, and it will:

1. Discover parameters across the query string, body, headers, cookies, and DOM.
2. Probe contexts to learn where each parameter lands (HTML, JavaScript, attribute, CSS).
3. Inject payloads tuned to each context, with optional WAF-evasion encoders.
4. Verify findings at the DOM level using an AST-backed parser, not just a text match.
5. Report results in the format your workflow speaks (plain, JSON, JSONL, Markdown, SARIF, TOML).

Who is Dalfox for?

• Pentesters & bug hunters: fast CLI reconnaissance that fits any recon stack.
• Security teams: SARIF output drops into GitHub Advanced Security or any SAST dashboard.
• Developers: a REST API and MCP server let CI/CD pipelines and AI agents drive scans without leaving their tools.

Where to start

Start with Installation, then work through the Quick Start. After that, the Guide covers deeper topics like WAF bypass and Stored XSS.

Coming from Dalfox v2 (Go)? Read Migrating from v2 first — subcommands were consolidated and several flags were renamed or retired.

In This Section

• Installation Install Dalfox on macOS, Linux, Windows, NixOS, Arch Linux, or build from source.
• Quick Start Your first Dalfox scan in five minutes.
• Configuration Save your favorite flags in a Dalfox config file.
• Migrating from v2 What changed between Dalfox v2 (Go) and v3 (Rust): consolidated subcommands, renamed flags, retired features, and their replacements.