Guide

The guide explains how Dalfox works: how it discovers parameters, which payloads run where, how Stored XSS detection works, how to handle WAFs, and what each finding proves.

Each page is self-contained. Read them in order the first time, then come back as reference.

Topics

• Scanning Modes: Single URL, file batch, pipe, raw HTTP, HAR, OpenAPI / Postman, stored and blind XSS, server, and MCP.
• Parameters & Discovery: How Dalfox finds inputs, prunes false positives, and mines wordlists.
• Payloads & Encoding: Built-in payload families, encoders, and custom wordlists.
• WAF Bypass: Fingerprinting WAFs and applying evasive mutations.
• Stored XSS: Inject on one URL, verify on another.
• Output & Reports: Plain, JSON, JSONL, Markdown, SARIF, TOML.
• Detection Model: What V / R / A / I mean, how each finding was produced, and what the evidence proves.

In This Section

• Scanning Modes Choose a Dalfox scan mode for URLs, files, pipelines, raw HTTP, HAR, OpenAPI / Postman specs, stored XSS, blind XSS, REST, or MCP.
• Parameters & Discovery Learn how Dalfox discovers, mines, filters, and tests query, body, header, cookie, path, fragment, GraphQL, and XML parameters.
• Payloads & Encoding Configure Dalfox XSS payload families, context-aware encoders, custom payloads, remote wordlists, blind XSS, and deep scans.
• WAF Bypass Configure Dalfox WAF detection, bypass strategies, evasion encoders, rate limits, and confidence thresholds.
• Stored XSS Use Dalfox to inject stored XSS on one URL and verify execution on a different retrieval URL.
• Output & Reports Export Dalfox XSS findings as plain text, JSON, JSONL, Markdown, SARIF, or TOML for CI and security pipelines.
• Detection Model Understand Dalfox finding confidence, detection method, severity, evidence tiers, DOM verification, and AST-based XSS results.