Dalfox

What it is

Dalfox v3 — an open-source XSS scanner and parameter-analysis tool, distributed as CLI, REST API, and MCP stdio server. v3 is a complete rewrite in Rust; the previous Go codebase lives on the v2 branch.

How it works

The CLI is organized into subcommands: scan, server, payload, and mcp. scan auto-detects its input type (URL, file, pipe, or raw HTTP). Beyond XSS detection (reflected, stored/SXSS, DOM-based with DOM/AST verification), it does parameter analysis, static analysis, BAV testing, and parameter mining. WAF handling includes fingerprinting with a confidence score you can gate on via --waf-min-confidence. Output can be emitted as JSON/JSONL/Plain/Markdown/SARIF/TOML — SARIF being the format that plugs into code-scanning pipelines.

What to do

Install via one of:

brew install dalfox
sudo snap install dalfox
yay -S dalfox
nix-shell -p dalfox

Statically-linked musl binaries for Linux are on the GitHub Releases page for environments without a package manager.

Invocation is dalfox [mode] [target] [flags]. Concrete patterns from the page:

dalfox scan http://example.com -b https://callback
dalfox scan urls.txt --custom-payload mypayloads.txt
cat urls.txt | dalfox scan --headers "AuthToken: xxx"

To pin exactly where payloads are injected — rather than letting Dalfox pick parameters — use a marker and point --inject-marker at it, in either the query or a header:

dalfox scan 'https://example.com/?q=FUZZ&page=1' --inject-marker FUZZ
dalfox scan https://example.com -H 'X-Search: FUZZ' --inject-marker FUZZ

The -b blind-XSS callback and --custom-payload file are the two flags most likely to matter for real targets.

Caveats

This is the v3 (Rust) line. If you depend on the Go tooling, it is not gone but frozen: the v2 branch receives security backports only — see SECURITY.md for the support policy and the migration guide for behavioral changes in v3. The Nix flake's latest releases may appear only in the unstable channel, so a stable-channel pull can lag.