X-DAL
dalfox
Fast, parameter-analysis-based XSS scanner written in Go, built for automation and pipeline use.
OVERVIEW
dalfox (github.com/hahwul/dalfox, dalfox.hahwul.com) is a Go-based XSS scanner that goes beyond payload spraying: it first analyzes where and how a parameter is reflected in the response (HTML body, attribute, JavaScript context, etc.) and only then generates and fires context-appropriate payloads, which keeps false positives lower than a blind fuzzing approach.
It can run against a single URL, a file of URLs (for pipeline use), or as a persistent server, and supports blind XSS via a callback URL, custom headers/cookies for authenticated scanning, and parameter mining to discover reflected inputs that weren’t in the original request.
USE CASES
Practical use cases
- 01
Triaging a large list of parameterized URLs from recon to find which ones reflect input in an exploitable context.
- 02
Verifying a suspected reflected-XSS finding with a real, context-aware payload instead of a generic alert(1) probe.
- 03
Testing for blind XSS on forms or admin-facing inputs using a callback (e.g., an XSS Hunter-style payload).
- 04
Running as a CI/CD or pipeline step against a staging environment to catch regressions before release.
QUICK START
Once URLs with parameters are enumerated, to quickly triage which ones reflect input in an exploitable context and verify real XSS.
- Confirm the target URL(s) and parameters are inside the authorized scope.
- Install dalfox (go install, a prebuilt binary, or the Docker image).
- Run it against a single URL, or a file of URLs for bulk scanning, adding auth headers/cookies if the app requires a session.
- For stored/blind scenarios, add a callback URL with --blind and check the callback service for hits.
- Manually confirm each reported finding in a browser before including it in the report.
dalfox url "https://target.example.com/search?q=test"BEFORE YOU RUN IT
What to check before running it
Even with context-aware analysis, treat every finding as a lead — confirm it fires in a real browser session before reporting, since WAFs and output encoding can produce misleading results either way.
Blind XSS payloads fire asynchronously, sometimes on internal admin tools you can't see directly — coordinate with the client on what a callback hit means and how to handle it.
Bulk scanning a large URL list sends a high volume of crafted requests; confirm this is acceptable under the engagement's rate limits before running it unattended.