# DalFox | Powerful Automated XSS Scanning Tool And Parameter Analyzer **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking\ **Created:** [March 7, 2022, 10:05am UTC](https://onehack.st/t/dalfox-powerful-automated-xss-scanning-tool-and-parameter-analyzer/216071 "2022-03-07T10:05:56Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [March 7, 2022, 10:05am UTC](https://onehack.st/t/dalfox-powerful-automated-xss-scanning-tool-and-parameter-analyzer/216071/1 "2022-03-07T10:05:56Z")
# [![](https://user-images.githubusercontent.com/13212227/120111054-49ffc780-c1ab-11eb-974e-e198d53ddb48.png)](https://github.com/hahwul/dalfox/blob/main) 🌙🦊=XSS [![](https://camo.githubusercontent.com/547adb88ee45ed3668f2e5807df3d7fabeb17b9c3476b12b51f6f8255594bf24/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f68616877756c2f64616c666f783f7374796c653d666c6174)](https://github.com/hahwul/dalfox/blob/main) [![](https://github.com/hahwul/dalfox/actions/workflows/go.yml/badge.svg)](https://github.com/hahwul/dalfox/actions/workflows/go.yml) [![](https://camo.githubusercontent.com/a2a43672aa9179719215e2a90aa3bacfae7f2bfcbf7f9737a37e542cedd08a94/68747470733a2f2f6170692e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f3137636163376238643165383439613638383537376632626264643665636430)](https://github.com/hahwul/dalfox/blob/main) [![](https://camo.githubusercontent.com/7e3e3507f90190235810c7050499ae295b4587c9d5366b3c24dde6611727478a/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f68616877756c2f64616c666f78)](https://goreportcard.com/report/github.com/hahwul/dalfox) [![](https://camo.githubusercontent.com/e47ea80abcdc3b468977c63050b43fcf06997de87ffc5c926413c61e80ca1e5f/68747470733a2f2f636f6465636f762e696f2f67682f68616877756c2f64616c666f782f6272616e63682f6d61696e2f67726170682f62616467652e737667)](https://codecov.io/gh/hahwul/dalfox) [![](https://camo.githubusercontent.com/334197d15a5a0f3246351fae457436876cb550d5e08941013d0e8f43a40526e1/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f68616877756c3f7374796c653d666c6174266c6f676f3d74776974746572)](https://twitter.com/intent/follow?screen_name=hahwul) [![](https://camo.githubusercontent.com/f5054ffcd4245c10d3ec85ef059e07aacf787b560f83ad4aec2236364437d097/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/hahwul/dalfox/blob/main) DalFox is an powerful open source XSS scanning tool and parameter analyzer and utility that fast the process of detecting and verify XSS flaws. It comes with a powerful testing engine, many niche features for the cool hacker I talk about naming. Dal([달](https://en.wiktionary.org/wiki/%EB%8B%AC)) is the Korean pronunciation of moon, and Fox are made to mean “Finder Of XSS” or 🦊 ## TOC - [Key features](https://github.com/hahwul/dalfox#key-features) - [How to Install](https://github.com/hahwul/dalfox#how-to-install) - [Usage](https://github.com/hahwul/dalfox#usage) - [POC format](https://github.com/hahwul/dalfox#poc-format) - [In the Code](https://github.com/hahwul/dalfox#in-the-code) - [Screenshots](https://github.com/hahwul/dalfox#screenshots) - [Wiki](https://github.com/hahwul/dalfox#wiki) - [Question](https://github.com/hahwul/dalfox#question) - [Changelog](https://github.com/hahwul/dalfox#changelog) - [Contributing](https://github.com/hahwul/dalfox#contributing) ## Key features Mode: `url` `sxss` `pipe` `file` `server` `payload` | Class | Key Feature | Description | | --- | --- | --- | | Discovery | Parameter analysis | - Find reflected param | - Find alive/bad special chars, event handler and attack code - Identification of injection points(HTML/JS/Attribute) `inHTML-none` `inJS-none` `inJS-double` `inJS-single` `inJS-backtick` `inATTR-none` `inATTR-double` `inATTR-single`| ||Static analysis|- Check bad-header like CSP, XFO, etc.. with req/res base| ||BAV analysis|- Testing BAV(Basic Another Vulnerability) , e.g `sqli` `ssti` `open-redirects`, `crlf`, `esii`| ||Parameter Mining|- Find new param with Dictonary attack (default is [GF-Patterns](https://github.com/1ndianl33t/Gf-Patterns)) - Support custom dictonary file (`--mining-dict-word`) - Find new param with DOM - Use remote wordlist to mining (`--remote-wordlists`)| ||Built-in Grepping|- It Identify the basic info leak of SSTi, Credential, SQL Error, and so on| ||WAF Detection and Evasion|- Detect to WAF(Web Application Firewall). - if found waf and using special flag, evasion using slow request - `--waf-evasion`| |Scanning|XSS Scanning|- Reflected XSS / Stored XSS / DOM XSS - DOM base verifying - Headless base verifying - Blind XSS testing with param, header(`-b` , `--blind` options) - Only testing selected parameters (`-p`, `--param`) - Only testing parameter analysis (`--only-discovery`)| ||Friendly Pipeline|- Single url mode (`dalfox url`) - From file mode (`dalfox file urls.txt`) - From IO(pipeline) mode (`dalfox pipe`) - From raw http request file mode (`dalfox file raw.txt --rawdata`)| ||Optimizaion query of payloads|- Check the injection point through abstraction and generated the fit payload. - Eliminate unnecessary payloads based on badchar| ||Encoder|- All test payloads(build-in, your custom/blind) are tested in parallel with the encoder. - To Double URL Encoder - To HTML Hex Encoder| ||Sequence|- Auto-check the special page for stored xss (`--trigger`) - Support (`--sequence`) options for Stored XSS , only `sxss` mode| |HTTP|HTTP Options|- Overwrite HTTP Method (`-X`, `--method`) - Follow redirects (`--follow-redirects`) - Add header (`-H`, `--header`) - Add cookie (`-C`, `--cookie`) - Add User-Agent (`--user-agent`) - Set timeout (`--timeout`) - Set Delay (`--delay`) - Set Proxy (`--proxy`) - Set ignore return codes (`--ignore-return`) - Load cookie from raw request (`--cookie-from-raw`)| |Concurrency|Worker|- Set worker’s number(`-w`, `--worker`)| ||N \* hosts|- Use multicast mode (`--multicast`) , only `file` / `pipe` mode| |Output|Output|- Only the PoC code and useful information is write as Stdout - Save output (`-o`, `--output`)| ||Format|- JSON / Plain (`--format`)| ||Printing|- Silence mode (`--silence`) - You may choose not to print the color (`--no-color`) - You may choose not to print the spinner (`--no-spinner`) - You may choose show only special poc code (`--only-poc`)| |Extensibility|REST API|- API Server and Swagger (`dalfox server`)| ||Payload Mode|- Generate and Enumerate Payloads for XSS Testing (`dalfox payload`)| ||Found Action|- Lets you specify the actions to take when detected. - Notify, for example (`--found-action`)| ||Custom Grepping|- Can grep with custom regular expressions on response - If duplicate detection, it performs deduplication (`--grep`)| ||Custom Payloads|- Use custom payloads list file (`--custom-payload`) - Custom alert value (`--custom-alert-value`) - Custom alert type (`--custom-alert-type`)| ||Remote Payloads|- Use remote payloads from portswigger, payloadbox, etc.. (`--remote-payloads`)| |Package|Package manager|- [pkg.go.dev](https://pkg.go.dev/github.com/hahwul/dalfox/v2) - [homebrew with tap](https://github.com/hahwul/homebrew-dalfox) - [snapcraft](https://snapcraft.io/dalfox)| ||Docker ENV|- [docker hub](https://hub.docker.com/repository/docker/hahwul/dalfox) - [gitub package of docker](https://github.com/hahwul/dalfox/packages)| ||Other|- [github action](https://github.com/marketplace/actions/xss-scan-with-dalfox)| And the various options required for the testing 😃 ## How to Install ### From source **go1.17** ```auto go install github.com/hahwul/dalfox/v2@latest ``` **go1.16** ```auto GO111MODULE=on go get github.com/hahwul/dalfox/v2 ``` ### Using homebrew (macos) ```auto brew tap hahwul/dalfox brew install dalfox ``` ### Using snapcraft (ubuntu) ```auto sudo snap install dalfox ``` More information? please read [Installation guide](https://dalfox.hahwul.com/docs/installation/) ## Usage ```auto ▶ dalfox [mode] [target] [flags] ``` Single target mode ```auto ▶ dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://hahwul.xss.ht ``` Multiple target mode from file ```auto ▶ dalfox file urls_file --custom-payload ./mypayloads.txt ``` Pipeline mode ```auto ▶ cat urls_file | dalfox pipe -H "AuthToken: bbadsfkasdfadsf87" ``` Other tips, See [wiki](https://github.com/hahwul/dalfox/wiki) for detailed instructions! ## POC format Sample poc log ```auto [POC][G][BUILT-IN/dalfox-error-mysql/GET] http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123DalFox [POC][V][GET] http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123%22%3E%3Csvg%2Fclass%3D%22dalfox%22onLoad%3Dalert%2845%29%3E ``` Format | Identity | Type | Information | BLANK | PoC Code | | --- | --- | --- | --- | --- | | POC | G | BUILT-IN/dalfox-error-mysql/GET | | [http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123DalFox](http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123DalFox) | | POC | R | GET | | [http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123"\>\](http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123%22%3E%3Csvg%2Fclass%3D%22dalfox%22onLoad%3Dalert%2845%29%3E) | | POC | V | GET | | [http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123"\>\](http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123%22%3E%3Csvg%2Fclass%3D%22dalfox%22onLoad%3Dalert%2845%29%3E) | - Type: `G`(Grep) , `R`(Reflected) , `V`(Verify) - Informatin: Method, grepping name, etc.. Why is there a gap? It is a method to make it easier to parse only the poc code through cut etc. For example, you can do this. ▶ dalfox url [http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff](http://testphp.vulnweb.com/listproducts.php%5C?cat%5C=123%5C&artist%5C=123%5C&asdf%5C=ff) | cut -d " " -f 2 \> output ▶ cat output [http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123DalFox](http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123DalFox) [http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123"\>\](http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123%22%3E%3Csvg%2FOnLoad%3D%22%60%24%7Bprompt%60%60%7D%60%22+class%3Ddalfox%3E) ## In the code package main import ( “fmt” dalfox “[github.com/hahwul/dalfox/v2/lib](http://github.com/hahwul/dalfox/v2/lib)” ) func main() { opt := dalfox.Options{ Cookie: “ABCD=1234”, } result, err := dalfox.NewScan(dalfox.Target{ URL: “[https://xss-game.appspot.com/level1/frame](https://xss-game.appspot.com/level1/frame)”, Method: “GET”, Options: opt, }) if err != nil { fmt.Println(err) } else { fmt.Println(result) } } ```auto $ go build -o xssapp ; ./xssapp [] [{V GET https://xss-game.appspot.com/level1/frame?query=%3Ciframe+srcdoc%3D%22%3Cinput+onauxclick%3Dprint%281%29%3E%22+class%3Ddalfox%3E%3C%2Fiframe%3E}] 2.618998247s 2021-07-11 10:59:26.508483153 +0900 KST m=+0.000794230 2021-07-11 10:59:29.127481217 +0900 KST m=+2.619792477} ``` ## Screenshots | [![1414](https://user-images.githubusercontent.com/13212227/108603497-7a390c80-73eb-11eb-92c1-b31bd9574861.jpg)](https://user-images.githubusercontent.com/13212227/108603497-7a390c80-73eb-11eb-92c1-b31bd9574861.jpg) | [![1415](https://user-images.githubusercontent.com/13212227/108603373-ebc48b00-73ea-11eb-9651-7ce4617845f6.jpg)](https://user-images.githubusercontent.com/13212227/108603373-ebc48b00-73ea-11eb-9651-7ce4617845f6.jpg) | | --- | --- | | Single URL Scanning | Massive(Multicast/Mass) Scanning | | [![1416](https://user-images.githubusercontent.com/13212227/108603375-ec5d2180-73ea-11eb-8e6e-d59d915c0291.jpg)](https://user-images.githubusercontent.com/13212227/108603375-ec5d2180-73ea-11eb-8e6e-d59d915c0291.jpg) | [![1417](https://user-images.githubusercontent.com/13212227/108613244-66b19400-7433-11eb-87fc-2f195f9011b3.jpg)](https://user-images.githubusercontent.com/13212227/108613244-66b19400-7433-11eb-87fc-2f195f9011b3.jpg) | | REST API Server Mode | Output and Customizing (found-action / grepping) | ## Wiki [Wiki](https://dalfox.hahwul.com/docs/home/) ## Question Please use [discussions](https://github.com/hahwul/dalfox/discussions) actively! ## Changelog Detailed changes for each release are documented in the [release notes](https://github.com/hahwul/dalfox/releases). ## Contributing DalFox’s open-source project and made it with ❤ if you want contribute this project, please see [CONTRIBUTING.md](https://github.com/hahwul/dalfox/blob/main/CONTRIBUTING.md) and Pull-Request with cool your contents. ## GitHub: [https://github.com/hahwul/dalfox](https://github.com/hahwul/dalfox)