Dalfox

Advanced XSS vulnerability scanner and parameter analysis tool

Web Vulnerabilities12 commands

#xss#scanner#automation#fuzzing#parameter

Installation

1Install using Go

2Download from GitHub releases

3Verify installation

# Using Go
go install github.com/hahwul/dalfox/v2@latest

# Or download from releases
wget https://github.com/hahwul/dalfox/releases/latest/download/dalfox_linux_amd64.tar.gz

# Verify
dalfox version

Basic Usage

Scan URLs for XSS vulnerabilities with automatic parameter detection

# Single URL scan
dalfox url https://example.com/page.php?name=test

# Scan from file
dalfox file urls.txt

# Passive mode with pipeline
cat urls.txt | dalfox pipe

# Blind XSS with callback
dalfox url https://example.com/page?q=1 --blind https://your.xss.ht

# Report output
dalfox url https://example.com/page?p=1 -o report.html

Command Reference

12 commands

1Scan a single URL

url

2Scan URLs from a file

file

3Scan URLs from stdin

pipe

4Set blind XSS callback URL

--blind

5Action when XSS is found

--found-action

6Save results to file

--output

7Output format (json/html)

--format

8Use dictionary for param mining

--mining-dict

9Set cookie for authenticated scans

--cookie

10Add custom headers

--header

11Delay between requests

--delay

12Request timeout in seconds

--timeout

When to Use

Scanning large lists of URLs for XSS

Automated XSS detection in CI/CD pipelines

Blind XSS testing with callback servers

Post-recon XSS analysis of collected URLs

Validating XSS findings with proof-of-concept

Notes & Tips

Written in Go — very fast compared to traditional XSS scanners

Supports WAF detection and bypass techniques

Can mine parameters from responses automatically

Integrates with Slack and Discord for notifications

Common Errors & Solutions

No XSS found

Try --mining-dict to discover more parameters, or use --deep for thorough scanning

Rate limited

Increase delay with --delay flag, rotate user-agents with --header

# Single URL scan dalfox url https://example.com/page.php?name=test # Scan from file dalfox file urls.txt # Passive mode with pipeline cat urls.txt | dalfox pipe # Blind XSS with callback dalfox url https://example.com/page?q=1 --blind https://your.xss.ht # Report output dalfox url https://example.com/page?p=1 -o report.html