One of the most frequently discussed web security flaws is XSS, where malicious code is inserted into a page viewed by other users. Finding it by hand takes care, since every input can end up in a different place on the page. Dalfox aims to cut down that work by automating the process of finding and verifying it.
What Is Dalfox?
Dalfox is an open source tool focused on automating the search for XSS flaws. It accepts a single URL, a file of URLs, or a crawl piped in from another tool, then runs its checks against them. Dalfox v3 is a complete rewrite in Rust, while the Go-based v2 codebase is preserved on the v2 branch and continues to receive security backports.
For those unfamiliar with the term, XSS is a flaw where an attacker manages to insert a script into a web page so that it runs in the visitor’s browser. The impact varies, from stolen session data to an altered page appearance. Dalfox helps find which points can be injected with such scripts.
How It Works
Dalfox works in several stages. First, it discovers parameters across the query string, request body, headers, cookies, and the DOM. It then probes the context of each parameter, that is, where the parameter lands inside the page, whether in HTML, JavaScript, an attribute, or CSS.
From there, payloads tuned to each parameter’s context are injected, with optional WAF-evasion encoders. Findings are verified directly against the parsed response, not just a plain text match. For markup contexts, verification uses an HTML parser, while script contexts use a JavaScript AST. This approach makes the reported findings more reliable.
Key Features
Dalfox has several subcommands, including scan for checking, server for the REST API, payload for managing payloads, and mcp for the MCP server. The scan mode can auto-detect the input source, whether from a URL, a file, a pipe, or raw HTTP.
On the discovery side, it offers parameter analysis, static analysis, BAV testing, and parameter mining. Its scanning covers reflected, stored (SXSS), and DOM-based XSS. For WAFs, there is fingerprinting with confidence scoring, bypass tracking, and a tunable threshold via --waf-min-confidence.
HTTP options are extensive, such as custom headers, cookies, methods, and proxies. Results can be output in JSON, JSONL, plain, Markdown, SARIF, and TOML formats, with a silence mode and detailed reports. Dalfox is also extensible through a REST API, an MCP stdio server, custom payloads, and remote wordlists.
Running It
Dalfox is invoked with the pattern dalfox [mode] [target] [flags]. The target can be a single URL, a file of URLs, or input from a pipe. There is also an option to set your own injection point via the FUZZ marker, either in the query or a header.
dalfox scan http://example.com -b https://callback
cat urls.txt | dalfox scan --headers "AuthToken: xxx"
dalfox scan 'https://example.com/?q=FUZZ&page=1' --inject-marker FUZZ
Dalfox can be installed through Homebrew, Snapcraft, AUR Arch Linux, Chocolatey, and Nix. Prebuilt binaries, including statically linked musl variants for Linux, are also available on the GitHub Releases page. For complete installation steps and more usage examples, follow the official documentation.
- Documentation: dalfox.hahwul.com
- CLI reference: dalfox.hahwul.com/reference/cli
- Quick start: dalfox.hahwul.com/getting-started/quick-start
Who Is It For?
Dalfox suits pentesters and bug hunters who need fast command-line reconnaissance that fits into any recon stack. Security teams can use it too, since SARIF output drops into GitHub Advanced Security or any SAST dashboard. For developers, the REST API and MCP server let CI/CD pipelines and AI agents drive scans without leaving their tools.
Things to Note
Dalfox is a security testing tool. It should only be used against systems you own or have permission to test. Scanning systems owned by others without authorization can be illegal.
The Rust-based v3 differs considerably from the Go-based v2. For those who used v2 before, a migration guide is available, and the support policy is explained in the SECURITY.md file in the repository.
Repository: https://github.com/hahwul/dalfox
If your work involves web security testing and XSS in particular, Dalfox can save time in the early reconnaissance stage. Full documentation and usage examples are available in the official repository.