
Fast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via CLI, pipeline, or REST API.
Looking for the Go (v2.x) version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the
v2branch and continues to receive security backports. See SECURITY.md for the support policy, and the migration guide for what changed in v3.
Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities.
scan (URL / file / pipe / raw-HTTP, auto-detected), server, payload, mcp--waf-min-confidenceAnd the various options required for the testing :D
brew install dalfox
# https://formulae.brew.sh/formula/dalfox
sudo snap install dalfox
yay -S dalfox
# or
paru -S dalfox
See the Installation guide for manual build instructions.
A package is available for Nix or NixOS users. Keep in mind that the latest releases might only
be present in the unstable channel.
nix-shell -p dalfox
For Nix users with flakes enabled:
# Run directly
nix run github:hahwul/dalfox -- scan https://example.com
# Install
nix profile install github:hahwul/dalfox
# Development environment for hacking on Dalfox itself
git clone https://github.com/hahwul/dalfox && cd dalfox && nix develop
The flake also exposes overlays.default, so NixOS and home-manager users can build Dalfox
against their own nixpkgs. See the Installation guide
for that module snippet and the rest of the details.
Prebuilt binaries (including statically-linked musl variants for Linux) are available on the GitHub Releases page.
dalfox [mode] [target] [flags]
dalfox scan http://example.com -b https://callbackdalfox scan urls.txt --custom-payload mypayloads.txtcat urls.txt | dalfox scan --headers "AuthToken: xxx"dalfox scan 'https://example.com/?q=FUZZ&page=1' --inject-marker FUZZdalfox scan https://example.com -H 'X-Search: FUZZ' --inject-marker FUZZCheck the CLI reference and Quick start documents for more examples.
if you want to contribute to this project, please see CONTRIBUTING.md and Pull-Request with cool your contents.
The name comes from 'Dal' (달) 🌙, the Korean word for 'moon', combined with 'Fox' 🦊.
