Guide

The guide covers the concepts that make Dalfox effective: how parameters are discovered, which payloads run where, how Stored XSS detection works, how to handle WAFs, and what each finding actually proves.

Each page is self-contained. Read them in order the first time, then come back as reference.

Topics

• Scanning Modes: Single URL, file batch, pipe, raw HTTP, HAR, stored and blind XSS, server, and MCP.
• Parameters & Discovery: How Dalfox finds inputs, prunes false-positives, and mines wordlists.
• Payloads & Encoding: Built-in payload families, encoders, and custom wordlists.
• WAF Bypass: Fingerprinting WAFs and applying evasive mutations.
• Stored XSS: Inject on one URL, verify on another.
• Output & Reports: Plain, JSON, JSONL, Markdown, SARIF, TOML.
• Detection Model: What V / R / A / I mean, how each finding was produced, and what the evidence proves.

In This Section

• Scanning Modes Single URL, file batch, pipeline, raw HTTP, HAR, stored and blind XSS, server, and MCP. Pick the mode that fits your workflow.
• Parameters & Discovery How Dalfox finds the inputs that matter, and how to steer the discovery phase.
• Payloads & Encoding Built-in payload families, encoders, custom payloads, and remote wordlists.
• WAF Bypass Detect WAFs automatically and apply per-WAF evasion strategies.
• Stored XSS Inject on one URL, verify the payload fires on another.
• Output & Reports Plain, JSON, JSONL, Markdown, SARIF, TOML, and how to integrate findings with your pipeline.
• Detection Model The three axes of a Dalfox finding (confidence, method, impact) and what each evidence tier actually proves.