Getting Started
This section takes you from zero to a verified XSS finding in about five minutes.
What is Dalfox?
Dalfox is an open-source XSS scanner and automation utility. Give it a URL, a file of URLs, or a piped crawl, and it will:
- Discover parameters in the query string, body, headers, cookies, path, and the input fields on the page.
- Probe contexts to learn where each parameter lands (HTML, JavaScript, attribute, CSS).
- Inject payloads chosen for each context, encoded and mutated to get past filters and WAFs.
- Verify findings in the parsed response instead of matching text: an HTML parser for markup and a JavaScript AST for script contexts.
- Report results in the format your workflow speaks (plain, JSON, JSONL, Markdown, SARIF, TOML).
Who is Dalfox for?
- Pentesters and bug hunters: a fast CLI that slots into any recon pipeline.
- Security teams: SARIF output loads into GitHub code scanning or any other tool that reads SARIF.
- Developers: a REST API and an MCP server let CI/CD pipelines and AI agents run scans from their own tools.
Where to start
Start with Installation, then work through the Quick Start. Configuration shows how to keep your usual flags in a config file. After that, the Guide covers deeper topics like WAF bypass and Stored XSS.
Coming from Dalfox v2 (Go)? Read Migrating from v2 first. The scan subcommands were merged into one, and several flags were renamed or removed.
In This Section
- Installation Install Dalfox, an open-source XSS scanner, on macOS, Linux, Windows, NixOS, Arch Linux, or from source.
- Quick Start Run your first Dalfox XSS scan in five minutes, then try files, pipelines, JSON output, authentication, and blind XSS.
- Configuration Save Dalfox scan flags in a TOML or JSON config file and understand precedence, defaults, and CLI overrides.
- Migrating from v2 Migrate from Dalfox v2 (Go) to v3 (Rust) with the new scan subcommand, renamed flags, retired features, and replacements.