Dalfox — The Cyber Toolchain

Dalfox v3.2.3

Tue, 15 Sep 2026 16:01:56 GMT

Dalfox v3.2.3 adds GraphQL and XML/SOAP injection surfaces, wider DOM-XSS AST coverage, and a new sub-not-gsub filter bypass detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds GraphQL and XML / SOAP request bodies as new injection surfaces for XSS scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Widens DOM-XSS AST coverage to include Promise combinators, optional chaining, and static bracket paths, with more sinks and sources and fewer false positives. • Detects the sub-not-gsub angle filter bypass: a doubled `<

Dalfox v3.2.2

Mon, 31 Aug 2026 12:36:17 GMT

Dalfox v3.2.2 adds WAF fingerprints for Wallarm/NAXSI/SafeLine, a `javascript` payload selector, and `dalfox completion` for shell completions. • Adds `dalfox completion` subcommand to generate shell completions, installed alongside the man page by packages. • Adds `dalfox payload javascript` selector to print canonical JavaScript execution payloads used in JS-string contexts. • Adds slash-separated attribute breakout payloads to `dalfox payload` for bypassing space-stripping filters. • Config files no longer override flags explicitly typed on the CLI, fixing flag-precedence for all subcommands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dalfox

Dalfox v3.2.1

Thu, 13 Aug 2026 15:46:38 GMT

dalfox v3.2.1 adds `all` payload selector, JSON payload output, closest-selector suggestions, modern JS framework detection, and server-side SSRF guards. • Adds `all` selector to `dalfox payload` to dump every static payload group in one pass. • Adds JSON output to `dalfox payload` for machine-readable payload lists. • Adds per-selector item counts to `dalfox payload` summary output. • Adds closest-selector suggestions to `dalfox payload` when an unknown selector is given (Levenshtein distance ≤ 2). • Expands `uri-scheme` and `special-chars` payload lists in `dalfox payload` (uri-scheme grows from 5 to 11 entries). • Adds modern JavaScript framework detection during scanning. • `dalfox server` now blocks browser-driven cross-site and DNS-rebinding requests by validating `Origin`, `Sec-Fetch-Site`, and `Host` headers. • REST and MCP `rate_limit` now applies to discovery and mining phases, not only scanning. • Cookie parameters are now injected as cookies rather than same-named headers, raising cookie recall from 80.0% to 87.5%. • Introduces `INTERNAL_ERROR` status code on `target_summary` entries so a scanner panic is reported as `skipped` rather than silently falling through to `clean`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dalfox

Dalfox v3.2.0

Sun, 02 Aug 2026 10:16:34 GMT

Dalfox v3.2.0 adds mass-scan resumption, baseline diffing, dedup, six new DOM-XSS sinks, HTTP QUERY method, and richer finding metadata. • New `--state-file` flag lets mass scans resume from where they left off, skipping already-completed targets. • New `--baseline` flag filters output to only findings that are new since a previous run, enabling diff-style reporting. • New `--dedup-urls` flag performs signature-level deduplication on large URL lists before scanning begins. • Session-loss detection now warns when authentication expires mid-scan rather than silently returning zero findings. • Six new DOM-XSS sinks detected: drag-drop events, async clipboard API, `FileReader`, `setAttributeNS`, indirect `eval`, and `DOMParser`. • Supports the HTTP `QUERY` method (RFC 10008) for scanning targets that use it. • MCP server gains `max_payloads_per_param` control and a synchronous wait mode for agent workflows. • Expanded `dalfox payload` selectors: `special-chars`, `functions`, `awesome-alert`, `dom-clobbering`, `mxss`, and `blind`. • Findings now carry three separate metadata axes: confidence, detection method, and impact. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dalfox

Dalfox v3.1.1

Sun, 21 Jun 2026 08:12:41 GMT

Dalfox v3.1.1 unifies server/MCP scan target params, consolidates debug logging, and bounds request fan-out for safer large scans. • Unifies scan target parameter: Server and MCP modes now accept `target` (REST retains `url` as a backward-compatible alias). • Consolidates all debug output through a single stderr `dbg_log!` macro, keeping JSON/JSONL/SARIF stdout clean under `--debug`. • Aligns OOB/blind XSS lifecycle messages with the standard timestamped log format (`INF`/`WRN`/`OOB`), making output consistent across scan modes. • Per-parameter payload safety cap and recall-preserving DOM-phase early-exit bound request fan-out, preventing runaway HTTP requests on wide parameter sets. • Bounds unbounded task spawning in parameter mining and cuts server hot-path lock-hold and allocations, improving reliability under load. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dalfox

Dalfox v3.1.1

Sun, 21 Jun 2026 08:12:41 GMT

Dalfox 3.1.1

Sun, 21 Jun 2026 08:12:41 GMT

Dalfox 3.1.1 unifies `target` parameter, enforces `-i` for stdin/file/pipe, bounds fan-out with per-payload cap and DOM early exit. • `--target` (alias `-t`) now serves as the unified argument for all scan types, including MCP server URLs; `url` remains a REST alias only • `url`, `file`, and `pipe` input sources now properly load config files, apply global flags, and require explicit `-i` flag to read from stdin Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dalfox

Dalfox v3.1.0

Sun, 14 Jun 2026 14:45:02 GMT

Dalfox v3.1.0 adds blind/OOB XSS via interactsh, HAR input, external JS analysis, CSP/Trusted Types awareness, and a global rate limiter. • Adds `--blind-oob` for out-of-band XSS detection using an interactsh OAST server, catching stored, async, and non-reflecting sinks. • Adds `--analyze-external-js` to fetch and AST-analyze same-origin `