# Dalfox Full Documentation > This file contains the combined content of all Dalfox documentation pages for LLM context ## In the Code # Using Dalfox in Your Code This guide provides detailed instructions on how to use Dalfox as a library in your Go projects. Follow the steps below to integrate Dalfox into your code. ## Get the Dalfox Library First, you need to download the Dalfox library using the `go get` command: ```bash go get github.com/hahwul/dalfox/v2/lib ``` ## Sample Code Here is a sample Go program that demonstrates how to use the Dalfox library to perform a scan: ```go package main import ( "fmt" dalfox "github.com/hahwul/dalfox/v2/lib" ) func main() { // Set up options for the scan opt := dalfox.Options{ Cookie: "ABCD=1234", } // Create a new scan target target := dalfox.Target{ URL: "https://xss-game.appspot.com/level1/frame", Method: "GET", Options: opt, } // Perform the scan result, err := dalfox.NewScan(target) if err != nil { fmt.Println("Error:", err) } else { fmt.Println("Scan Result:", result) } } ``` ## Running the Code To run the sample code, follow these steps: ### Initialize Your Project First, initialize your Go module: ```bash go mod init ``` Replace `` with the path to your project repository. ### Build the Application Next, build your application: ```bash go build -o testapp ``` During the build process, Go will download the Dalfox library and its dependencies. ### Run the Application Finally, run your application: ```bash ./testapp ``` You should see output similar to the following: ```bash # [] [{V GET https://xss-game.appspot.com/level1/frame?query=%3Ciframe+srcdoc%3D%22%3Cinput+onauxclick%3Dprint%281%29%3E%22+class%3Ddalfox%3E%3C%2Fiframe%3E}] 2.618998247s 2021-07-11 10:59:26.508483153 +0900 KST m=+0.000794230 2021-07-11 10:59:29.127481217 +0900 KST m=+2.619792477 ``` ## More Information For more information and advanced usage, please refer to the [official Dalfox library documentation](https://pkg.go.dev/github.com/hahwul/dalfox/v2). --- ## Custom Tranport Feature # Custom Transport Feature {: .d-inline-block } Since (v2.10.0) {: .label .label-blue } Dalfox now supports custom HTTP transports, allowing you to customize the HTTP client behavior for your scanning needs. This feature is particularly useful when integrating Dalfox with other pipelines for HTTP control flow, retry mechanisms, and non-trivial authentication scenarios. ## What is a Transport? In Go's HTTP client, a transport specifies how HTTP requests are made. It handles details like connection pooling, timeouts, TLS configuration, and more. By customizing the transport, you can control how Dalfox makes HTTP requests. ## Benefits for Pipeline Integration Custom transports provide several benefits when integrating Dalfox into larger security testing pipelines: 1. **HTTP Control Flow**: Customize how requests are made, including adding custom headers, modifying request bodies, or implementing custom routing logic. 2. **Retry Mechanisms**: Implement resilient scanning by automatically retrying failed requests with configurable backoff strategies. 3. **Authentication**: Handle complex authentication flows like OAuth2, JWT, or custom token-based authentication. 4. **Rate Limiting**: Control the rate of requests to avoid being blocked by target systems. 5. **Logging and Monitoring**: Add custom logging or monitoring to track requests and responses. 6. **Proxy Integration**: Seamlessly integrate with custom proxy solutions or service meshes. ## How to Use Custom Transports ### 1. Using a Custom Transport with a Custom TLS Configuration ```go // Create a custom transport with a custom TLS configuration customTransport := scanning.CreateDefaultTransport(10) // 10 seconds timeout customTransport.TLSClientConfig = &tls.Config{ InsecureSkipVerify: true, MinVersion: tls.VersionTLS12, MaxVersion: tls.VersionTLS13, } // Create options with the custom transport options := model.Options{ CustomTransport: customTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### 2. Using a Transport Chain You can chain multiple transports together to apply multiple transformations to your requests: ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create multiple header transports headerTransport1 := &scanning.HeaderTransport{ Transport: baseTransport, Headers: map[string]string{ "X-Custom-Header1": "Value1", }, } headerTransport2 := &scanning.HeaderTransport{ Transport: baseTransport, Headers: map[string]string{ "X-Custom-Header2": "Value2", }, } // Create a transport chain with both transports transportChain := scanning.CreateTransportChain(headerTransport1, headerTransport2) // Create options with the transport chain options := model.Options{ CustomTransport: transportChain, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### 3. Using a Retry Transport for Resilient Scanning Implement automatic retries for failed requests: ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create a retry transport retryTransport := &scanning.RetryTransport{ Transport: baseTransport, MaxRetries: 3, RetryDelay: time.Second, RetryBackoff: 2, // Exponential backoff } // Create options with the retry transport options := model.Options{ CustomTransport: retryTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### 4. Using an OAuth2 Transport for Authenticated Scanning Handle OAuth2 authentication flows: ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create an OAuth2 transport oauth2Transport := &scanning.OAuth2Transport{ Transport: baseTransport, TokenEndpoint: "https://auth.example.com/token", ClientID: "client_id", ClientSecret: "client_secret", Scope: "read write", } // Create options with the OAuth2 transport options := model.Options{ CustomTransport: oauth2Transport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### 5. Using a Rate Limiting Transport Control the rate of requests to avoid being blocked: ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create a rate limit transport rateLimitTransport := &scanning.RateLimitTransport{ Transport: baseTransport, RequestsPerSec: 5, // 5 requests per second } // Create options with the rate limit transport options := model.Options{ CustomTransport: rateLimitTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### 6. Using a Logging Transport for Debugging Add detailed logging for debugging: ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create a logging transport loggingTransport := &scanning.LoggingTransport{ Transport: baseTransport, LogWriter: os.Stdout, // Or any io.Writer } // Create options with the logging transport options := model.Options{ CustomTransport: loggingTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ## Creating Your Own Custom Transport You can create your own custom transport by implementing the `http.RoundTripper` interface: ```go // MyCustomTransport is a custom transport that does something special type MyCustomTransport struct { Transport http.RoundTripper // Add any fields you need } // RoundTrip implements the http.RoundTripper interface func (t *MyCustomTransport) RoundTrip(req *http.Request) (*http.Response, error) { // Clone the request to avoid modifying the original reqClone := req.Clone(req.Context()) // Do something special with the request // ... // Use the underlying transport return t.Transport.RoundTrip(reqClone) } ``` ## Integration Examples ### Integrating with a Corporate Proxy ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Configure the proxy baseTransport.Proxy = http.ProxyURL(&url.URL{ Scheme: "http", Host: "corporate-proxy.example.com:8080", User: url.UserPassword("username", "password"), }) // Create options with the proxy transport options := model.Options{ CustomTransport: baseTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ### Integrating with a CI/CD Pipeline ```go // Create a base transport baseTransport := scanning.CreateDefaultTransport(10) // Create a CI/CD integration transport cicdTransport := &CICDTransport{ Transport: baseTransport, BuildID: os.Getenv("CI_BUILD_ID"), JobID: os.Getenv("CI_JOB_ID"), ResultsAPI: "https://ci-results.example.com/api/v1/results", } // Create options with the CI/CD transport options := model.Options{ CustomTransport: cicdTransport, Timeout: 10, } // Use the options in a scan Scan("https://example.com", options, "1") ``` ## Notes - If you provide a custom transport, Dalfox will still apply proxy settings if specified, but only if your transport is of type `*http.Transport`. - If you provide a custom transport, Dalfox will still apply the HAR writer if specified. - The custom transport feature is designed to be used with the library mode of Dalfox. If you're using the CLI, you'll need to create a custom application that uses the library mode. - When implementing custom transports, always clone the request before modifying it to avoid side effects. - For complex authentication flows, consider implementing a transport that handles token refresh and retry logic. --- ## File Mode # File mode `file` mode is a mode for scanning multiple URLs or for scanning based on a raw request file in Burp Suite/ZAP. Input is filename. ```shell dalfox file {filename} ``` If the file is a list of URLs, proceed to scan multiple URLs just like the Pipe, and if it is with the `--rawdata` option, recognize it as a raw request, analyze the file, and test it. ## scanning urls from file ```shell dalfox file urls.txt ``` ## scanning from burp/zap raw request file ```shell dalfox file req.raw --rawdata ``` --- ## In the GitHub Actions # Using Dalfox in GitHub Actions ## Overview GitHub Actions enables you to automate your security testing processes directly in your GitHub repositories. By integrating Dalfox with GitHub Actions, you can: - Automatically scan for XSS vulnerabilities when code is pushed - Include security testing in your pull request workflows - Create scheduled security scans of your web applications - Generate reports on security findings as part of your CI/CD pipeline This guide explains how to set up and use Dalfox in GitHub Actions workflows for various scanning scenarios. ## Available Actions Dalfox offers official GitHub Actions in the GitHub Marketplace: * [XSS Scan with Dalfox](https://github.com/marketplace/actions/xss-scan-with-dalfox) * [hahwul/action-dalfox](https://github.com/hahwul/action-dalfox) ## Getting Started ### Basic Usage To integrate Dalfox in your GitHub Actions workflow, add a step similar to the following to your workflow file: ```yaml - name: Dalfox XSS Scan uses: hahwul/action-dalfox@main id: xss-scan with: target: 'https://example.com/search?q=test' mode: url cmd_options: '--follow-redirects --format json' ``` This basic example will scan the specified URL for XSS vulnerabilities using Dalfox. ### Input Parameters The Dalfox GitHub Action accepts the following inputs: | Parameter | Description | Required | Default | |-----------|-------------|----------|---------| | `target` | The target URL or URLs to scan | Yes | - | | `mode` | Scan mode (url, pipe, file, sxss) | Yes | - | | `cmd_options` | Additional Dalfox command options | No | '' | ### Scan Modes Dalfox supports several scanning modes in GitHub Actions: - `url`: Scan a single URL - `pipe`: Scan multiple URLs provided in the target parameter - `file`: Scan URLs from a file (requires checkout of your repository) - `sxss`: Test for stored XSS vulnerabilities ### Output Handling The action provides the scan results in the `result` output variable: ```yaml - name: Dalfox XSS Scan uses: hahwul/action-dalfox@main id: xss-scan with: target: 'https://example.com/search?q=test' mode: url - name: Display Results run: echo "Scan results - ${{ steps.xss-scan.outputs.result }}" ``` ## Workflow Examples ### On-demand Single URL Scan This workflow runs a Dalfox scan when manually triggered: ```yaml name: XSS Security Scan on: workflow_dispatch: inputs: url: description: 'URL to scan' required: true default: 'https://example.com' jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: ${{ github.event.inputs.url }} mode: url cmd_options: '--follow-redirects --format json --report' - name: Display Results run: echo "${{ steps.xss-scan.outputs.result }}" ``` ### Scheduled Multi-URL Scan This workflow runs daily to scan multiple URLs: ```yaml name: Daily XSS Scans on: schedule: - cron: '0 0 * * *' # Run at midnight every day jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: | https://example.com/search?q=test https://example.com/products?id=123 https://example.com/news?article=latest mode: pipe cmd_options: '--follow-redirects --format json --report --output scan-results.json' - name: Upload scan results uses: actions/upload-artifact@v3 with: name: xss-scan-results path: scan-results.json retention-days: 30 ``` ### Pull Request Security Check This workflow scans the web application whenever a pull request is opened or updated: ```yaml name: Pull Request XSS Check on: pull_request: branches: [ main ] paths: - 'frontend/**' - 'web/**' jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Checkout uses: actions/checkout@v3 - name: Set up test environment run: | # Set up your application for testing # E.g., npm install && npm start echo "Starting application on http://localhost:3000" - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: 'http://localhost:3000' mode: url cmd_options: '--follow-redirects --deep-domxss --format json' - name: Check for vulnerabilities run: | if [[ "${{ steps.xss-scan.outputs.result }}" == *"[POC]"* ]]; then echo "::warning::XSS vulnerabilities were found! Check the scan results." exit 1 fi ``` ## Advanced Usage ### Scanning with a Configuration File You can use a Dalfox configuration file in your GitHub Actions workflow: ```yaml name: Configured XSS Scan on: [push] jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Checkout uses: actions/checkout@v3 - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: 'https://example.com' mode: url cmd_options: '--config ./security/dalfox-config.json' ``` ### Integrating with Security Platforms You can send Dalfox results to security platforms using the `--found-action` option: ```yaml name: XSS Scan with Notifications on: [push] jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Checkout uses: actions/checkout@v3 - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: 'https://example.com' mode: url cmd_options: '--found-action "curl -X POST -H \"Content-Type: application/json\" -d \"{\\\"text\\\":\\\"XSS Found: \$\$POCURL\\\"}\" https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"' ``` ### File-Based Scanning This workflow uses a list of URLs from a file in your repository: ```yaml name: File-Based XSS Scan on: [push] jobs: security_scan: runs-on: ubuntu-latest name: Dalfox XSS Scanner steps: - name: Checkout uses: actions/checkout@v3 - name: Dalfox scan uses: hahwul/action-dalfox@main id: xss-scan with: target: './security/target-urls.txt' mode: file cmd_options: '--mass-worker 5 --format json --output scan-results.json' - name: Upload scan results uses: actions/upload-artifact@v3 with: name: xss-scan-results path: scan-results.json ``` ## Best Practices ### Security Considerations 1. **Token Permissions**: Be careful with workflow token permissions when scanning internal applications 2. **Rate Limiting**: Adjust worker count and delay settings to avoid overwhelming your applications 3. **Secret Management**: Use GitHub Secrets for sensitive values like API tokens or webhook URLs ### Performance Optimization 1. **Selective Scanning**: Only scan URLs that have changed or are affected by recent code changes 2. **Parallel Jobs**: For large applications, split scanning tasks across multiple parallel jobs 3. **Resource Allocation**: Adjust worker settings based on the GitHub Actions runner resources ```yaml # Example of efficient resource usage cmd_options: '--worker 50 --delay 100 --timeout 5' ``` ### Workflow Integration 1. **Reporting Integration**: Send results to your security management platforms 2. **Issue Creation**: Automatically create GitHub issues for detected vulnerabilities 3. **PR Status Checks**: Make PR approvals dependent on security scan results ```yaml # Example of creating a GitHub issue for vulnerabilities - if: ${{ steps.xss-scan.outputs.result != '' }} name: Create Issue uses: actions/github-script@v6 with: script: | github.rest.issues.create({ owner: context.repo.owner, repo: context.repo.repo, title: 'XSS Vulnerability Detected', body: 'Dalfox found XSS vulnerabilities in the latest scan:\n\n```\n${{ steps.xss-scan.outputs.result }}\n```' }) ``` ## Troubleshooting ### Common Issues 1. **Action fails with timeout**: - Increase the timeout value in cmd_options - Reduce the number of targets or parallel workers 2. **Empty results**: - Verify that your target is accessible from GitHub Actions runners - Check if your application requires authentication - Try running with `--debug` option to see more details 3. **Permission errors**: - Ensure the action has proper permissions to access resources - Authenticate properly if scanning authenticated pages ### Getting Help If you encounter issues with Dalfox GitHub Actions: - Check the [Dalfox GitHub repository issues](https://github.com/hahwul/dalfox/issues) - Join the [Dalfox community discussions](https://github.com/hahwul/dalfox/discussions) - Report specific GitHub Actions issues in the [action-dalfox repository](https://github.com/hahwul/action-dalfox/issues) --- ## Installation # Installation Guide This guide provides detailed instructions on how to install Dalfox using various methods. Choose the method that best suits your environment and technical preferences. ## Using Homebrew Homebrew is a popular package manager for macOS and Linux. If you're using a system with Homebrew available, this is the quickest and easiest way to install Dalfox. ### Install Homebrew If you haven't installed Homebrew yet, you can install it by running the following command in your terminal: ```shell /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" ``` ### Install Dalfox Once Homebrew is installed, you can install Dalfox with a single command: ```shell brew install dalfox ``` After installation, verify it's working by running: ```shell dalfox --version ``` For more details about the Dalfox Homebrew package, you can visit the [Homebrew Formula page for Dalfox](https://formulae.brew.sh/formula/dalfox). ## Using Snapcraft Snapcraft is a package manager for Linux that works across many distributions. It provides containerized applications that run consistently regardless of the underlying system. ### Install Snapcraft To install Snapcraft on your Linux distribution, please refer to the official documentation: [Installing snapd](https://snapcraft.io/docs/installing-snapd). ### Install Dalfox Once Snapcraft is installed, you can install Dalfox by running: ```shell sudo snap install dalfox ``` Verify the installation with: ```shell dalfox --version ``` ## From Source Building from source gives you the most up-to-date version of Dalfox and allows for customization if needed. ### Prerequisites Ensure you have Go (version 1.16 or later recommended) installed on your system. You can download it from the [official Go website](https://golang.org/dl/). ### Install Dalfox To install the latest version of Dalfox from source, run: ```bash go install github.com/hahwul/dalfox/v2@latest ``` Make sure your Go bin directory is in your PATH. If you haven't set it up, you can add the following to your shell configuration file (e.g., `.bashrc` or `.zshrc`): ```bash export PATH=$PATH:$(go env GOPATH)/bin ``` Note: The installed version might differ slightly from the latest release as `go install` references the main branch. ## Using Docker Docker provides a consistent environment for running Dalfox without worrying about dependencies or system configurations. This is especially useful for CI/CD pipelines or isolated testing environments. ### Pull the Latest Docker Image To pull the latest Docker image of Dalfox, run: ```bash # From Docker Hub docker pull hahwul/dalfox:latest # Or from GitHub Container Registry docker pull ghcr.io/hahwul/dalfox:latest ``` ### Run Dalfox Using Docker You can run Dalfox using Docker with the following command: ```bash # Using Docker Hub image docker run -it hahwul/dalfox:latest /app/dalfox url https://www.example.com # Using GitHub Container Registry image docker run -it ghcr.io/hahwul/dalfox:latest /app/dalfox url https://www.example.com ``` For scanning local files or directories, you'll need to mount them to the container: ```bash docker run -it -v $(pwd):/data hahwul/dalfox:latest /app/dalfox file /data/targets.txt ``` ### Interactive Docker Shell For an interactive shell within the Docker container (useful for more complex operations): ```bash # Using Docker Hub image docker run -it hahwul/dalfox:latest /bin/bash # Using GitHub Container Registry image docker run -it ghcr.io/hahwul/dalfox:latest /bin/bash ``` Once inside the container, you can run Dalfox directly: ```bash ./dalfox --help ``` ## Troubleshooting Common Installation Issues If you encounter issues during installation, try the following: 1. **PATH Issues**: Ensure the installation directory is in your PATH 2. **Permission Errors**: Use `sudo` for commands that require elevated privileges 3. **Version Conflicts**: Check if you have multiple versions installed For more help, please open an issue on the [Dalfox GitHub repository](https://github.com/hahwul/dalfox/issues). --- ## MCP Mode # Dalfox MCP Mode {: .d-inline-block } New (v2.11.0) {: .label .label-blue } ## Overview Model Context Protocol (MCP) mode allows Dalfox to operate as an MCP server, enabling direct integration with AI assistants and language models (LLMs). This integration provides a seamless experience for security testing, allowing AI tools to directly leverage Dalfox's XSS scanning capabilities. ## What is Model Context Protocol (MCP)? Model Context Protocol is a specification that allows AI language models to interact with external tools. By running Dalfox as an MCP server, AI coding assistants can: - Initiate XSS vulnerability scans - Process scan results within the AI conversation - Help interpret security findings - Suggest remediation steps ## Starting Dalfox in MCP Mode To run Dalfox as an MCP server: ```bash dalfox server --type mcp ``` ## Client Integrations ### Visual Studio Code VS Code provides robust support for MCP tools when used with AI coding assistants like GitHub Copilot or other MCP-compatible extensions. #### Configuration Steps 1. **Install Dalfox** (if not already installed) ```bash # From source go install github.com/hahwul/dalfox/v2@latest # Homebrew brew install dalfox # Snapcraft snap install dalfox ``` *[Installation](/page/installation/)* 2. **Configure VS Code settings** To enable the dalfox server in VS Code, update your `settings.json` file with the following configuration: ```json { "mcp": { "servers": { "dalfox": { "type": "stdio", "command": "dalfox", "args": [ "server", "--type=mcp" ] } } } } ``` This setup defines a server named dalfox that uses standard input/output (stdio) and runs the command `dalfox server --type=mcp`. You can manually add the server by pressing `⌘` + `⇧` + `p`, selecting MCP: Add Server, choosing `Command (stdio)`, and entering `dalfox server --type=mcp` in the input field. This ensures seamless integration of the dalfox server with your VS Code environment. 3. **Use with AI assistant** Now your AI coding assistant can directly use Dalfox to scan for XSS vulnerabilities. For example, you can ask: ``` "Can you scan this URL for XSS vulnerabilities using Dalfox?" ``` #### Example VS Code Usage ![](/images/page/running/mcp-vscode.jpg) ### Claude Desktop Claude Desktop is Anthropic's standalone application that can integrate with external tools using the MCP protocol. #### Configuration Steps 1. **Install Dalfox** (if not already installed) ```bash # From source go install github.com/hahwul/dalfox/v2@latest # Homebrew brew install dalfox # Snapcraft snap install dalfox ``` *[Installation](/page/installation/)* 2. **Configure Claude Desktop settings** ```json { "mcpServers": { "dalfox": { "command": "dalfox", "args": [ "server", "--type", "mcp" ] } } } ``` 3. **Use with Claude** You can now use Dalfox directly through Claude's interface: ``` "Can you scan https://xss-game.appspot.com/level1/frame for XSS vulnerabilities" ``` #### Example Claude Desktop Usage ![](/images/page/running/mcp-claude.jpg) ## Advanced MCP Integration ### Custom Scan Options When using Dalfox through MCP, you can specify various scan options by providing them in your request: ``` "Scan https://example.com with Dalfox using the following options: - Custom headers with an authorization token - Cookie-based authentication - A blind XSS callback URL" ``` The AI assistant will translate these requests into the appropriate Dalfox commands. ## Use Cases ### Security Code Review Ask your AI assistant to review code and then scan endpoints for vulnerabilities: ``` "Review this controller code and identify any potential XSS vulnerabilities. Then use Dalfox to scan the corresponding endpoints." ``` ### Vulnerability Research Have the AI assistant help with targeted testing: ``` "I found a potential XSS vulnerability in the search parameter. Can you use Dalfox to verify if it's exploitable?" ``` ## Best Practices 1. **Keep Dalfox Updated**: Ensure you're using the latest version for the most current security checks 2. **Validate Results**: Always verify AI-interpreted scan results manually for critical systems 3. **Rate Limiting**: Be mindful of scan frequency to avoid overwhelming target systems 4. **Context Matters**: Provide AI assistants with sufficient context about targets for more effective scanning 5. **Security Awareness**: Remember that scan results might contain sensitive information --- ## Output Handling # Output Handling This guide provides comprehensive instructions on how to capture, filter, and process the output from Dalfox. Understanding these output handling techniques will help you efficiently interpret results and integrate Dalfox into your security workflows. ## Understanding Dalfox Output Types Dalfox generates several types of output during scanning: - **Progress information**: Status updates about the scanning process - **Proof of Concept (PoC) findings**: Actual vulnerabilities discovered - **Analysis data**: Details about parameters, injection points, and vulnerability verification - **HTTP traffic**: Raw request and response data ## Basic Output Handling Techniques ### Redirecting Output to Files The simplest way to save Dalfox output is by using standard output redirection: ```bash dalfox url http://example.com/vulnerable.php > results.txt ``` This captures all console output to the specified file. ### Using the Built-in Output Flag For more controlled output saving, use the `-o` or `--output` flag: ```bash dalfox url http://example.com/vulnerable.php -o results.txt ``` This approach is recommended as it ensures proper handling of terminal control characters. ## Advanced Output Filtering ### Processing Output with Unix Tools Dalfox output can be piped to other tools for filtering and processing: ```bash # Extract only verified XSS vulnerabilities dalfox url http://example.com/vulnerable.php | grep "\[V\]" > verified_xss.txt # Extract PoC URLs and open them in a browser dalfox url http://example.com/vulnerable.php | grep "\[POC\]" | cut -d " " -f 2 | xargs -I % open % # Count different types of findings dalfox url http://example.com/vulnerable.php | grep "\[POC\]" | cut -d "[" -f 3 | cut -d "]" -f 1 | sort | uniq -c ``` ### Filtering by PoC Type Dalfox allows you to filter findings by vulnerability type with the `--only-poc` flag: ```bash # Show only verified (V) and grep-based (G) findings dalfox url http://example.com/vulnerable.php --only-poc=g,v ``` Available PoC types: - `g`: Grep-based findings (potential vulnerabilities identified through response pattern matching) - `r`: Reflected findings (parameters successfully reflected in responses) - `v`: Verified findings (confirmed vulnerabilities through headless browser verification) ## Comprehensive Logging Options ### Capturing Complete Scan Logs To save all scan information, including detailed analysis steps: ```bash dalfox url http://example.com/vulnerable.php -o full_scan.log --output-all ``` Example of a comprehensive log: ``` [*] Using single target mode [*] Target URL: http://example.com/vulnerable.php [*] Valid target [ code:200 / size:4819 ] [*] Using dictionary mining option [list=GF-Patterns] 📚⛏ [*] Using DOM mining option 📦⛏ [*] Start static analysis.. 🔍 [*] Start parameter analysis.. 🔍 [*] Start BAV analysis / [sqli, ssti, OpenRedirect] 🔍 [I] Found reflected parameter: q [V] Triggered XSS Payload: q= [POC][V][GET] http://example.com/vulnerable.php?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E ``` ### Including Raw HTTP Data To include raw HTTP requests and responses in your output: ```bash # Include requests dalfox url http://example.com/vulnerable.php --output-request # Include responses dalfox url http://example.com/vulnerable.php --output-response # Include both dalfox url http://example.com/vulnerable.php --output-request --output-response ``` ## Output Format Options ### JSON Output For programmatic processing or integration with other tools, use JSON output: ```bash dalfox url http://example.com/vulnerable.php --format json -o results.json ``` This generates structured JSON data that can be easily parsed by scripts or imported into other security tools. ### Detailed Report Generation For comprehensive reporting: ```bash dalfox url http://example.com/vulnerable.php --report --report-format json -o detailed_report.json ``` ## HTTP Archive (HAR) Integration ### Generating HAR Files HAR files contain detailed information about HTTP transactions and can be analyzed in various tools: ```bash dalfox url http://example.com/vulnerable.php --har-file-path=scan.har ``` ### Analyzing HAR Files The generated HAR file can be analyzed with: - [HAR Viewer](http://www.softwareishard.com/har/viewer/) - Chrome/Firefox Developer Tools (Import HAR) - Specialized HTTP analysis tools Example HAR viewer screenshot: ![HAR Viewer Example](https://user-images.githubusercontent.com/369053/218365521-5df5ff3c-759e-4bb8-9205-a45ac25481ca.png) ## Integration with Other Security Tools ### Automated Workflows Dalfox can be integrated into CI/CD pipelines or other security automation: ```bash # Scan and notify on findings dalfox url http://example.com/vulnerable.php --found-action './notify_slack.sh' # Scan multiple targets from Burp Suite dalfox file targets.txt --format json -o findings.json ``` ### Continuous Monitoring Examples ```bash # Daily scan with timestamped output echo "$(date +%F)_scan.log" dalfox url http://example.com/vulnerable.php -o "$(date +%F)_scan.log" ``` ## Troubleshooting Output Issues If you encounter problems with output handling: 1. **Terminal encoding issues**: Use `--no-color` to disable ANSI color codes 2. **Output truncation**: Check terminal buffer settings or use file output 3. **Special character problems**: Use JSON output format for consistent encoding For more information on output formats and report interpretation, see the [JSON Format Documentation](../advanced/resources/json/) and [PoC Format Documentation](../advanced/resources/format-of-poc/). --- ## Overview # Overview Dalfox is a powerful open-source tool designed for automated detection of XSS (Cross-Site Scripting) vulnerabilities. With its advanced testing engine and comprehensive feature set, Dalfox simplifies the process of scanning, analyzing parameters, and verifying vulnerabilities. Whether you are performing quick scans or detailed analyses, Dalfox provides a streamlined experience tailored to the needs of security professionals and researchers. ![Dalfox Screenshot](/images/screen.jpeg) The name "Dalfox" has a unique origin: - **Dal ([달](https://en.wiktionary.org/wiki/달))**: The Korean word for "moon." - **Fox**: An acronym for "Finder Of XSS" 🦊. Key highlights of Dalfox include: - **Flexible Scanning Modes**: Supports URL-based scans, file-based inputs, pipelines, and server modes for versatile testing approaches. - **Comprehensive Analysis**: Detects reflected, stored, and DOM-based XSS vulnerabilities, along with parameter mining and static analysis to ensure thorough coverage. - **Extensibility**: Offers custom payloads, remote wordlists, and API integrations for highly tailored testing to meet your specific requirements. - **Performance Optimization**: Features such as payload abstraction, bad character filtering, and parallel encoding substantially improve efficiency and reduce scan times. - **Detailed Reporting**: Outputs can be formatted as plain text or JSON, with options for in-depth reports to facilitate clear communication of findings. ## Contributors Dalfox is an open-source project made with ❤️ If you want to contribute to this project, please see [CONTRIBUTING.md](https://github.com/hahwul/dalfox/blob/main/CONTRIBUTING.md) and submit a Pull Request with your contributions. [![Contributors](https://github.com/hahwul/dalfox/raw/main/CONTRIBUTORS.svg)](https://github.com/hahwul/dalfox/graphs/contributors) --- ## Payload Mode # Payload Mode `payload` mode is a mode for easy testing of XSS. Generate and Enumerate XSS Payloads and wordlists ```bash dalfox payload {flags} ``` e.g ```bash dalfox payload --enum-injs --entity-event-handler" ``` ## Make-Bulk Make-bulk generates many xss payloads. At this point, the parameters of the alert are configured as sequence and it is easy to find which payload was triggered during the XSS test. ```bash dalfox payload --make-bulk ``` output ```html ...snip... test<\/track> test<\/tt> test<\/u>
    test<\/ul> test<\/var>