5.8K
Dalfox is an amazing Parameter Analysis and XSS scanning tool.
Dalfox typically means,
Dal = moon (Korean pronunciation ) ; Fox = Find of XSS.
Contents
Dalfox Features:
- Parameter Analysis (find reflected parameter, find free/bad characters, Identification of injection point)
- Static Analysis (Check Bad-header like CSP, X-Frame-options, etc.. with base request/response base)
- Optimization query of payloads
- Check the injection point through abstraction and generated the fit payload.
- Eliminate unnecessary payloads based on bad char
- XSS Scanning(Reflected + Stored) and DOM Base Verifying
- All test payloads(build-in, your custom/blind) are tested in parallel with the encoder.
- Support to Double URL Encoder
- Support to HTML Hex Encoder
- Friendly Pipeline (single URL, from a file, from IO)
- And the various options required for the testing 😀
- built-in/custom grepping to find other vulnerability
- if you found, after action
- etc..
Editor’s choice:
- Macof – Ultimate Flooding Tool | Tutorial[2020]
- NWAnime – Best Alternatives of NWAnime [2020]
- CCMAKER – Download Ultimate Adobe Piracy Kit[2020]
- LOSMOVIES – The Best Movie Streaming Website Alive
How to install Dalfox?
There are total of three ways to install Dalfox.
You can use anyone of them.
1. Go-Install
- First simply clone this repository.
$ git clone https://github.com/hahwul/dalfox
- Install in cloned Dalfox path
$ go install
- Using dalfox
$ ~/go/bin/dalfox
2. Go-Get
- go get dalfox!
$ go get -u github.com/hahwul/dalfox
- Using dalfox
$ ~/go/bin/dalfox
3. Release version
- Open latest release page https://github.com/hahwul/dalfox/releases/latest
- Download file Download and extract the file that fits your OS.
- You can put it in the execution directory and use it. e.g
$ cp dalfox /usr/bin/
Usage of Dalfox:
_..._
.' .::::. __ _ _ ___ _ __ __
: :::::::: | \ / \ | | | __/ \\ V /
: :::::::: | o ) o || |_ | _( o )) (
'. '::::::' |__/|_n_||___||_| \_//_n_\
'-.::''
Parameter Analysis and XSS Scanning tool based on golang
Finder Of XSS and Dal is the Korean pronunciation of moon. @hahwul
Usage:
dalfox [command]
Available Commands:
file Use file mode(targets list or rawdata)
help Help about any command
pipe Use pipeline mode
sxss Use Stored XSS mode
update Update DalFox (Binary patch)
url Use single target mode
version Show version
Flags:
-b, --blind string Add your blind xss (e.g -b hahwul.xss.ht)
--config string Using config from file
-C, --cookie string Add custom cookie
--custom-payload string Add custom payloads from file
-d, --data string Using POST Method and add Body data
--delay int Milliseconds between send to same host (1000==1s)
--found-action string If found weak/vuln, action(cmd) to next
--grep string Using custom grepping file (e.g --grep ./samples/sample_grep.json)
-H, --header string Add custom headers
-h, --help help for dalfox
--ignore-return string Ignore scanning from return code (e.g --ignore-return 302,403,404)
--only-discovery Only testing parameter analysis
-o, --output string Write to output file
--output-format string -o/--output 's format (txt/json/xml)
-p, --param string Only testing selected parameters
--proxy string Send all request to proxy server (e.g --proxy http://127.0.0.1:8080)
--silence Not printing all logs
--timeout int Second of timeout (default 10)
--user-agent string Add custom UserAgent
-w, --worker int Number of worker (default 40)
$ dalfox [mode] [flags]
Single target mode
$ dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://hahwul.xss.ht
Multiple target mode from file
$ dalfox file urls_file --custom-payload ./mypayloads.txt
Pipeline mode
$ cat urls_file | dalfox pipe -H "AuthToken: bbadsfkasdfadsf87"
Download Dalfox:
Conclusion:
Dalfox is an amazing tool you can use.
If you have found value in this article. Make sure to comment down below and boost the enthusiasm of our team.
You can also give any suggestions or questions regarding this tool.
Our team will try to respond you as soon as possible.