Guide

The guide covers the concepts that make Dalfox effective: how parameters are discovered, which payloads run where, how Stored XSS detection works, and how to handle WAFs.

Each page is self-contained. Read them in order the first time, then come back as reference.

Topics

• Scanning Modes: Single URL, file batch, pipe, stored-XSS, server, and MCP.
• Parameters & Discovery: How Dalfox finds inputs, prunes false-positives, and mines wordlists.
• Payloads & Encoding: Built-in payload families, encoders, and custom wordlists.
• WAF Bypass: Fingerprinting WAFs and applying evasive mutations.
• Stored XSS: Inject on one URL, verify on another.
• Output & Reports: Plain, JSON, JSONL, Markdown, SARIF, TOML.

In This Section

• Scanning Modes Single URL, file batch, pipeline, stored XSS, server, and MCP. Pick the mode that fits your workflow.
• Parameters & Discovery How Dalfox finds the inputs that matter, and how to steer the discovery phase.
• Payloads & Encoding Built-in payload families, encoders, custom payloads, and remote wordlists.
• WAF Bypass Detect WAFs automatically and apply per-WAF evasion strategies.
• Stored XSS Inject on one URL, verify the payload fires on another.
• Output & Reports Plain, JSON, JSONL, Markdown, SARIF, TOML, and how to integrate findings with your pipeline.
• Detection Model The three subsystems that find XSS, which flags govern each, and what V / A / R / I are actually evidence of.