Dalfox is an open-source XSS scanner and utility focused on automation for detecting cross-site scripting vulnerabilities.
The tool addresses the need for rapid, reliable XSS detection across multiple vulnerability types including reflected, stored, and DOM-based XSS. It combines parameter discovery through static analysis and parameter mining with an advanced testing engine that performs DOM and AST verification to reduce false positives. The scanner includes WAF fingerprinting with confidence scoring and bypass tracking, allowing testers to understand and work around web application firewalls during assessments.
Dalfox suits security researchers and bug bounty hunters who need to scan multiple targets efficiently. It handles various input modes including single URLs, file lists, and piped input, with flexible injection point specification via custom markers. The tool supports multiple output formats including JSON, JSONL, Markdown, SARIF, and TOML for integration into different workflows. It offers extensibility through a REST API and MCP stdio server, plus the ability to use custom payloads and remote wordlists. The project is written in Rust, which distinguishes it from its earlier Go-based version that remains available on a separate branch with security backports.
The project maintains active development with regular updates and welcomes community contributions. The codebase underwent a complete rewrite from Go to Rust, with clear documentation of migration paths and support policies for users of the earlier version.
