Dalfox

Visit Website

Introduction

Dalfox is a scanner dedicated to cross-site scripting (XSS). It finds the parameters on a target, probes which characters survive in each context, injects payloads and then checks every hit in the parsed HTML and JavaScript before reporting it, so each finding is graded by the evidence behind it. The name combines the Korean word for moon, Dal, with Fox.

Version 3 is a complete rewrite in Rust. The older Go codebase lives on a v2 branch and still receives security backports, and there is a migration guide for v3.

Its scanning covers reflected, stored and DOM-based XSS with DOM and AST verification. Discovery includes parameter analysis, static analysis, BAV (basic additional vulnerability) testing and parameter mining. A WAF module fingerprints firewalls with confidence scoring, tracks bypasses and lets you tune --waf-min-confidence.

Dalfox is built for automation. The scan subcommand accepts a URL, a file of URLs, piped input, raw HTTP requests or HAR files, auto-detecting which. You can set custom headers, cookies, methods and proxies, mark a custom injection point with a placeholder, and supply custom payloads or remote wordlists. Output formats include JSON, JSONL, plain text, Markdown, SARIF and TOML, so results can feed code-scanning dashboards in CI.

It also runs as a REST API server and as an MCP stdio server, letting an AI agent call it as a tool. Install via Homebrew, prebuilt binaries for macOS, Linux and Windows (including static musl builds), Docker, Nix or from source. As with any active scanner, use it only on targets you are authorised to test.

The source code is at hahwul/dalfox on GitHub under the MIT licence, with about 5,400 stars; the most recent commit was on 11 November 2026.

XSS remains one of the most common web vulnerabilities, partly because it hides in many small corners: search boxes, error messages, query parameters reflected in templates and client-side routing. A specialised scanner is useful precisely because it goes deep on that one class, testing many contexts and encodings that a general scanner may skip.

In practice, Dalfox fits two workflows. In reconnaissance, security testers pipe in URLs gathered by crawlers and let Dalfox triage which parameters are injectable. In CI, teams run it against a staging deployment and upload SARIF so new XSS findings appear in code scanning alongside other results.

Tune it for your environment: set realistic headers and cookies for authenticated pages, limit concurrency to avoid overloading staging, and use the WAF confidence settings if a firewall sits in front of the app. Treat verified findings as high priority, since DOM verification means the payload actually executed in the parsed page.

Remember that a clean XSS scan is not proof of safety; it means the scanner found nothing in the paths it reached. Keep output encoding, content security policy and framework defaults as the real defences.

Its MCP server mode is a newer twist: an AI assistant can call Dalfox as a tool during a security review, which keeps the scanning deterministic while the assistant handles triage.

Features

1. XSS coverage: Reflected, stored and DOM-based.
2. Evidence-based verification: Hits checked in the parsed DOM and AST.
3. Parameter discovery: Analysis and mining.
4. WAF fingerprinting: Confidence scoring and bypass tracking.
5. Flexible input: URLs, files, pipes, raw HTTP and HAR.
6. Custom injection points: Mark queries or headers with a placeholder.
7. Output formats: JSON, JSONL, Markdown, SARIF and more.
8. Server modes: REST API and MCP stdio server.
9. Custom payloads: Your own payloads and remote wordlists.
10. Rust performance: Single fast binary.

Pros

1. Focused and accurate: Specialised in XSS with verification.
2. Pipeline-friendly: SARIF output and stdin input.
3. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
4. Actively maintained: The repository had commits as recent as 11 November 2026.
5. Community: About 5,400 GitHub stars.

Cons

1. Single vulnerability class: XSS only; pair with broader scanners.
2. v3 migration: Flags changed from the Go version.
3. Active testing: Authorised targets only.

Usage and Links (Example)

brew install dalfox
dalfox scan http://example.com -b https://callback
cat urls.txt | dalfox scan --headers "AuthToken: xxx"
dalfox scan 'https://example.com/?q=FUZZ&page=1' --inject-marker FUZZ

Resources:

• Dalfox website
• GitHub repository

Pricing

Dalfox is free and open source under the MIT licence.

Recommended for?

1. Bug bounty hunters and pentesters automating XSS checks.
2. AppSec teams adding XSS scanning to CI with SARIF output.
3. Agent builders exposing an XSS scanner over MCP.

Conclusion

Dalfox is a fast, verification-first XSS scanner that fits both manual recon and automated pipelines.

Combine it with a general DAST tool for full coverage.

On CheckOps, Dalfox is filed under the Security testing and Release & CI gates stages. Related tools listed here include OWASP ZAP, Burp Suite, Nuclei, ffuf, Wapiti and SQLMap. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.