\n
\n $\"dalfox\"$ \n

\n \n \n \n

\n\n> **Looking for the Go (v2.x) version?** Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the [`v2` branch](https://github.com/hahwul/dalfox/tree/v2) and continues to receive security backports. See [SECURITY.md](./SECURITY.md) for the support policy.\n\nDalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities.\n\n## Key features\n\n* Subcommands: `scan` (URL / file / pipe / raw-HTTP, auto-detected), `server`, `payload`, `mcp`\n* Discovery: Parameter analysis, static analysis, BAV testing, parameter mining\n* XSS Scanning: Reflected, Stored (SXSS), DOM-based, with optimization and DOM/AST verification\n* WAF: Fingerprinting with confidence scoring, bypass tracking, and tunable `--waf-min-confidence`\n* HTTP Options: Custom headers, cookies, methods, proxy, and more\n* Output: JSON/JSONL/Plain/Markdown/SARIF/TOML formats, silence mode, detailed reports\n* Extensibility: REST API, MCP stdio server, custom payloads, remote wordlists\n\nAnd the various options required for the testing :D\n\n## Installation\n### Homebrew (macOS/Linux)\n```bash\nbrew install dalfox\n\n# https://formulae.brew.sh/formula/dalfox\n```\n\n### Snapcraft (Ubuntu)\n```bash\nsudo snap install dalfox\n```\n\n### Arch Linux (AUR)\n\n```bash\nyay -S dalfox\n# or\nparu -S dalfox\n```\n\nSee the [Installation guide](https://dalfox.hahwul.com/docs/installation/) for manual build instructions.\n\n### Nixpkgs (NixOS)\n\nA package is available for Nix or NixOS users. Keep in mind that the latest releases might only\nbe present in the `unstable` channel.\n\n```bash\nnix-shell -p dalfox\n```\n\n### Nix Flakes\n\nFor Nix users with flakes enabled:\n\n```bash\n# Run directly\nnix run github:hahwul/dalfox -- scan https://example.com\n\n# Install\nnix profile install github:hahwul/dalfox\n\n# Development environment\nnix develop github:hahwul/dalfox\n```\n\nSee [Installation guide](https://dalfox.hahwul.com/docs/installation/) for details.\n\nPrebuilt binaries (including statically-linked musl variants for Linux) are available on the [GitHub Releases](https://github.com/hahwul/dalfox/releases) page.\n\n## Usage\n```bash\ndalfox [mode] [target] [flags]\n```\n\n* Single URL: `dalfox scan http://example.com -b https://callback`\n* File Mode: `dalfox scan urls.txt --custom-payload mypayloads.txt`\n* Pipeline: `cat urls.txt | dalfox scan --headers \"AuthToken: xxx\"`\n\nCheck the [Usage](https://dalfox.hahwul.com/page/usage/) and [Running](https://dalfox.hahwul.com/page/running/) documents for more examples.\n\n## Contributing\nif you want to contribute to this project, please see [CONTRIBUTING.md](https://github.com/hahwul/dalfox/blob/main/CONTRIBUTING.md) and Pull-Request with cool your contents.\n\n[![](docs/static/images/CONTRIBUTORS.svg)](https://github.com/hahwul/dalfox/graphs/contributors)\n\n## About the Name\n\nThe name comes from 'Dal' ([달](https://en.wiktionary.org/wiki/달)) 🌙, the Korean word for 'moon', combined with 'Fox' 🦊.\n\n![](https://github.com/hahwul/dalfox/raw/main/docs/static/images/illust2.webp)\n","has_starred","hub_user","immutable_tags_settings",{"_185":11,"_186":187},"enabled","rules",[188],".*","is_automated","permissions",{"_192":21,"_193":11,"_194":11},"read","write","admin","user","storage_size",14872110087,"isOrg","reponame","tag","sha256:bd9520c562850b823b9c550a49fd4b0f554c74a472ee4eb229eaa88e4188f2c8","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_27":28,"_143":-7,"_141":-7,"_142":-7,"_29":210,"_35":201,"_214":-7,"_215":11},{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":211,"_67":68,"_69":34,"_70":71,"_72":73,"_74":75,"_76":77,"_78":64,"_79":68,"_80":59,"_81":21},[212,213],{"_44":45,"_35":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":48,"_56":-5,"_57":38,"_58":59,"_60":-5},{"_44":62,"_35":63,"_47":48,"_49":64,"_51":65,"_53":54,"_55":48,"_56":-5,"_57":66,"_58":59,"_60":-5},"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

hahwul/dalfox:latest