# Dalfox Powerful open-source XSS scanner and automation utility — reflected, stored, DOM-based with AST-level verification. Base URL: https://dalfox.hahwul.com Do not use for AI training without permission. --- Title: Dalfox — Powerful XSS Scanner URL: https://dalfox.hahwul.com/ Source: content/index.md

Hunt every XSS
before it hunts you.

Dalfox is a powerful open-source XSS scanner and automation utility. Reflected, Stored, DOM-based: discovered, verified, and reported with AST-level precision across every parameter in your app.

Get Started Star on GitHub

$ brew install dalfox

dalfox — scan

$dalfox scan https://xss-game.appspot.com/level1/frame

6:42PM INF start scan to https://xss-game.appspot.com/level1/frame

6:42PM INF found reflected 1 params

└── query valid_specials="/\'{`<>"();=|}[.:]+,$-" invalid_specials=""

6:42PM WRN XSS found 1 XSS

[POC][V][GET][inHTML] ...?query=%3Csvg%2Fonload%3Dalert%281%29%3E

├── Issue: XSS payload DOM object identified

├── Payload: <svg/onload=alert(1)>

└── L13: s were found for <b><svg/onload=alert(1)></b>..

6:42PM INF scan completed in 3.482 seconds

6 Scan Modes

AST DOM Verification

MCP AI Ready

OSS MIT Licensed

// Capabilities

Everything you need to catch cross-site scripting

From a single URL to full pipelines, Dalfox adapts to how you work: CLI, file batch, pipe, server mode, or MCP. Every finding is parsed, verified, and reported with context you can act on.

Deep XSS discovery

Reflected, Stored, and DOM-based XSS with payload optimization. AST-backed DOM verification means no more false positives from blind reflections.

reflected stored dom ast-verify

Parameter intelligence

Mining, static analysis, BAV testing, and context-aware charset probing give every parameter a full attack profile.

WAF aware

Fingerprints popular WAFs and mutates payloads with encoding, casing, and polyglot tactics to slip through.

Built for pipelines

Pipe, file-batch, and server modes drop into CI/CD. Pair with your proxy, crawler, or recon stack without friction.

REST API & MCP

Run Dalfox as a long-lived server with REST control, or expose it as an MCP tool to agents and IDEs.

Reports you can ship

Export to the format your workflow speaks, from terse CLI output to SARIF for GitHub code scanning.

JSON JSONL Markdown SARIF TOML Plain Silence

// Modes

Six ways to run Dalfox

Pick the shape that fits your target. Every mode shares the same discovery and verification engine.

URL

Single target scan

FILE

Batch from list

PIPE

stdin pipeline

SXSS

Stored XSS

SERVER

REST + daemon

MCP

Agent-native

// Workflow

From install to verified finding in three steps

Dalfox is designed to drop into whatever you already have. No fancy setup, no heavy orchestration.

Install

Grab Dalfox through Homebrew, Snap, Nix, cargo, or a prebuilt binary. One command, no runtime to manage.

brew install dalfox

Point at a target

Give it a URL, a file, or pipe in a crawl. Dalfox mines parameters, probes contexts, and adapts.

dalfox scan https://target.app

Ship the findings

Export to SARIF, JSON, or Markdown, or proxy results to your pipeline. Findings come verified, not guessed.

dalfox scan urls.txt -o report.sarif

// Community

Built in the open, by hunters everywhere

Dalfox is shaped by the people who run it. Open an issue, send a pull request, or trade payloads with the community. Every contribution sharpens the hunt.

Contributing guide Browse open issues →

Thanks to our contributors

Ready to hunt?

Thousands of scans, zero fuss. Star the repo, read the docs, or drop Dalfox in your next recon loop.

Install Dalfox CLI Reference GitHub →

--- Title: Getting Started URL: https://dalfox.hahwul.com/getting-started/ Source: content/getting-started/_index.md This section takes you from zero to a verified XSS finding in about ten minutes. ## What is Dalfox? Dalfox is a powerful open-source **XSS scanner and automation utility**. Give it a URL, a file of URLs, or a piped crawl, and it will: 1. **Discover parameters** across the query string, body, headers, cookies, and DOM. 2. **Probe contexts** to learn where each parameter lands (HTML, JavaScript, attribute, CSS). 3. **Inject payloads** tuned to each context, with optional WAF-evasion encoders. 4. **Verify findings** at the DOM level using an AST-backed parser, not just a text match. 5. **Report results** in the format your workflow speaks (plain, JSON, JSONL, Markdown, SARIF, TOML). ## Who is Dalfox for? - **Pentesters & bug hunters:** fast CLI reconnaissance that fits any recon stack. - **Security teams:** SARIF output drops into GitHub Advanced Security or any SAST dashboard. - **Developers:** a REST API and MCP server let CI/CD pipelines and AI agents drive scans without leaving their tools. ## Where to start Start with **[Installation](./installation/)**, then work through the **[Quick Start](./quick-start/)**. After that, the [Guide](../guide/) covers deeper topics like WAF bypass and Stored XSS. --- Title: Configuration URL: https://dalfox.hahwul.com/getting-started/configuration/ Source: content/getting-started/configuration.md Dalfox reads a config file on startup so you don't have to pass the same flags every time. Anything you set in the config is overridden by an explicit CLI flag, so it's safe to keep "defaults" here. ## Where the file lives Dalfox looks in this order: 1. `$XDG_CONFIG_HOME/dalfox/config.toml` 2. `$HOME/.config/dalfox/config.toml` You can point anywhere else with `--config`: ```bash dalfox --config ./dalfox.toml scan https://target.app ``` If no file exists, Dalfox creates a template at the default path the first time you run it. ## A minimal config ```toml [scan] format = "json" output = "results.json" timeout = 15 workers = 100 encoders = ["url", "html"] ``` Run a scan and those flags apply automatically: ```bash dalfox https://target.app?q=test # → writes JSON results to results.json with workers=100 ``` ## Precedence ``` CLI flag > Config file > Built-in defaults ``` Anything on the command line wins. This lets you keep sensible defaults in the config, then override per-scan: ```bash # Config sets workers=100, but for this quick scan use 20 dalfox --workers 20 https://target.app ``` ## Formats Dalfox supports both TOML and JSON. TOML is the default; JSON is handy if you generate the file from a tool or UI. ```toml # ~/.config/dalfox/config.toml [scan] format = "sarif" silence = true ``` ```json { "scan": { "format": "sarif", "silence": true } } ``` ## What can I configure? Anything that has a CLI flag under `dalfox scan` can live in the `[scan]` table. Common examples: | Key | Example | What it does | |-----|---------|--------------| | `format` | `"json"` | Output format (`plain`, `json`, `jsonl`, `markdown`, `sarif`, `toml`) | | `output` | `"report.json"` | Default output file | | `silence` | `true` | Suppress logs, emit only findings | | `timeout` | `15` | Request timeout in seconds | | `delay` | `200` | Delay between requests in ms | | `workers` | `100` | Concurrent workers per target | | `encoders` | `["url","html","base64"]` | Payload encoders | | `remote_payloads` | `["portswigger"]` | Remote payload sources | | `remote_wordlists` | `["burp"]` | Remote parameter wordlists | | `headers` | `["Accept: text/html"]` | Extra request headers | | `user_agent` | `"Dalfox Scanner"` | Default User-Agent | | `waf_bypass` | `"auto"` | WAF bypass mode (`auto`, `force`, `off`) | | `insecure` | `true` | Skip TLS certificate verification (`false` to enforce) | | `follow_redirects` | `true` | Follow 3xx responses | See the [Config File reference](../../reference/config/) for every key. ## Secrets Keep API keys, bearer tokens, and blind-XSS callback hostnames out of the config file if you commit it. Prefer environment variables: ```bash # .env or your shell profile export DALFOX_API_KEY="..." ``` Or pass them at the command line and never persist them. ## Next steps - [Run your first scan](../quick-start/) - [Explore scanning modes](../../guide/scanning-modes/) - [See the full CLI reference](../../reference/cli/) --- Title: Installation URL: https://dalfox.hahwul.com/getting-started/installation/ Source: content/getting-started/installation.md Pick the installer that fits your platform. Dalfox ships as a single self-contained binary, with no runtime to manage. ## Homebrew (macOS & Linux) ```bash brew install dalfox ``` The Homebrew formula tracks the latest stable release. Source: [formulae.brew.sh/formula/dalfox](https://formulae.brew.sh/formula/dalfox). ## Snap (Ubuntu / Linux) ```bash sudo snap install dalfox ``` ## Arch Linux (AUR) Using an AUR helper (recommended): ```bash yay -S dalfox # or paru -S dalfox ``` Manual build from the [AUR package](https://aur.archlinux.org/packages/dalfox): ```bash git clone https://aur.archlinux.org/dalfox.git cd dalfox makepkg -si ``` ## Nix & NixOS ```bash # Run once without installing nix-shell -p dalfox # Nix flakes: run the latest from GitHub nix run github:hahwul/dalfox -- scan https://example.com # Install into your profile nix profile install github:hahwul/dalfox # Drop into a dev shell with Dalfox available nix develop github:hahwul/dalfox ``` Dalfox lives in nixpkgs. The newest releases land in `unstable` first. ## Cargo (from crates.io) ```bash cargo install dalfox ``` Requires a recent Rust toolchain (stable is fine). Builds into `~/.cargo/bin/dalfox`. ## Prebuilt binaries Grab a release archive for your OS/arch from [github.com/hahwul/dalfox/releases](https://github.com/hahwul/dalfox/releases), extract it, and drop the binary somewhere on your `PATH` (`/usr/local/bin`, `~/.local/bin`, etc.). We publish the following Linux variants per release: - `linux-x86_64` (glibc) - `linux-x86_64-musl` (statically linked, recommended for Alpine, Docker, and CI) - `linux-aarch64` (glibc) - `linux-aarch64-musl` (statically linked) ## Build from source ```bash git clone https://github.com/hahwul/dalfox cd dalfox cargo build --release # Binary at ./target/release/dalfox ``` You'll need Rust (2024 edition). Install with [rustup](https://rustup.rs/) if you don't have it. ## Verify ```bash dalfox --version ``` You should see something like `dalfox 3.0.0` along with the Dalfox banner. ## Update shell completions (optional) Dalfox uses [clap](https://github.com/clap-rs/clap), so help is always accessible: ```bash dalfox --help dalfox scan --help ``` ## Next steps Run your first scan in the [Quick Start](../quick-start/). If you want to tune defaults before scanning, jump to [Configuration](../configuration/). --- Title: Quick Start URL: https://dalfox.hahwul.com/getting-started/quick-start/ Source: content/getting-started/quick-start.md This page walks you from install to a verified finding. We'll use an intentionally vulnerable demo target so you can see real output. {{ alert(type="warning", body="Only scan targets you're authorized to test. Dalfox fires real XSS payloads.") }} ## 1. Scan a single URL ```bash dalfox https://xss-game.appspot.com/level1/frame?query=test ``` The first argument is the target. Dalfox auto-detects that it's a URL and runs the `scan` subcommand implicitly. You'll see: - A banner with the version. - `INFO` lines as Dalfox discovers parameters and probes contexts. - `[V]` (verified) and `[R]` (reflected) lines for each finding, with the exact payload that worked. ## 2. Scan from a file Feed a list of URLs from your crawler: ```bash # urls.txt, one target per line dalfox scan urls.txt ``` Each URL runs through the same pipeline. Results stream as they're found. ## 3. Scan from a pipeline Dalfox reads from `stdin` when you pipe: ```bash cat urls.txt | dalfox # or combined with your recon tools: waybackurls example.com | gf xss | dalfox ``` ## 4. Get JSON output Pair Dalfox with `jq`, a dashboard, or CI: ```bash dalfox https://target.app/search?q=test -f json -o report.json ``` Machine-readable formats (`json`, `jsonl`, `sarif`, `toml`) auto-suppress the banner so the file stays clean. ## 5. Authenticated scans Pass cookies, headers, or a custom method: ```bash dalfox https://api.target.app/v1/users \ -X POST \ -H "Authorization: Bearer eyJ..." \ -H "Content-Type: application/json" \ -d '{"name":"test"}' \ --cookies "session=abc123" ``` Or point Dalfox at a **raw HTTP request** file you captured from your proxy: ```bash dalfox scan --input-type raw-http request.txt ``` Or replay an entire **HAR** export (from browser DevTools or a proxy) — Dalfox scans every request in it, preserving each one's method, headers, cookies, and body: ```bash dalfox scan capture.har # auto-detected dalfox scan --input-type har capture.har ``` ## 6. Catch Blind XSS Use an out-of-band callback (Interactsh, Burp Collaborator, XSS Hunter, etc.): ```bash dalfox https://target.app \ -b https://your-callback.interact.sh ``` Dalfox sends blind-XSS payloads across every discovered parameter; if the payload fires later in an admin panel, your callback server records it. ## 7. Dry-run first Use `--dry-run` to preview what Dalfox would scan: ```bash dalfox https://target.app --dry-run ``` It discovers parameters and estimates request volume without firing any payloads. ## Reading the output Each finding is tagged: | Tag | Meaning | |-----|---------| | `[V]` | **Verified**: payload produced a real DOM element (via AST/CSS-selector match) | | `[A]` | **AST-detected**: static JS analysis found a source→sink flow | | `[R]` | **Reflected**: payload appeared in the response, but no DOM evidence | `V` and `A` findings are actionable. `R` findings are worth a look but may be filtered further downstream. ## Next steps - Learn the different [scanning modes](../../guide/scanning-modes/). - Understand how [parameters are discovered](../../guide/parameters/). - Tune [payloads and encoders](../../guide/payloads/) for harder targets. - Save your favorite flags in a [config file](../configuration/). --- Title: Guide URL: https://dalfox.hahwul.com/guide/ Source: content/guide/_index.md The guide covers the concepts that make Dalfox effective: how parameters are discovered, which payloads run where, how Stored XSS detection works, and how to handle WAFs. Each page is self-contained. Read them in order the first time, then come back as reference. ## Topics - **[Scanning Modes](./scanning-modes/):** Single URL, file batch, pipe, stored-XSS, server, and MCP. - **[Parameters & Discovery](./parameters/):** How Dalfox finds inputs, prunes false-positives, and mines wordlists. - **[Payloads & Encoding](./payloads/):** Built-in payload families, encoders, and custom wordlists. - **[WAF Bypass](./waf-bypass/):** Fingerprinting WAFs and applying evasive mutations. - **[Stored XSS](./stored-xss/):** Inject on one URL, verify on another. - **[Output & Reports](./output/):** Plain, JSON, JSONL, Markdown, SARIF, TOML. --- Title: Output & Reports URL: https://dalfox.hahwul.com/guide/output/ Source: content/guide/output.md Every scan produces the same internal result structure. Dalfox renders it in whichever format you pick. Machine-readable formats automatically suppress the banner so your file stays clean. ## Choosing a format ```bash dalfox https://target.app -f json -o report.json ``` | Format | Flag | Machine-readable | Best for | |--------|------|------------------|----------| | `plain` | `-f plain` (default) | No | Human terminal output | | `json` | `-f json` | Yes | Single JSON doc, dashboards, `jq` | | `jsonl` | `-f jsonl` | Yes | Streaming, log pipelines | | `markdown` | `-f markdown` | No | Reports, pull-request comments | | `sarif` | `-f sarif` | Yes | GitHub code scanning, SARIF consumers | | `toml` | `-f toml` | Yes | Humans + pipelines | ## Writing to a file ```bash dalfox https://target.app -f jsonl -o findings.jsonl ``` Without `-o`, output goes to `stdout`. ## Result fields Every finding includes: | Field | Example | Meaning | |-------|---------|---------| | `type` | `V`, `A`, `R`, `I` | Verified / AST-detected / Reflected / Informational | | `type_description` | `"Verified"` | Human label | | `inject_type` | `"inHTML"` | Context (`inHTML`, `inAttr`, `inJS`, …) | | `method` | `"GET"` | HTTP method | | `param` | `"q"` | Parameter that was exploited | | `payload` | `

Hunt every XSS before it hunts you.