dalfox3.2.4

Dalfox scans targets for reflected, stored, and DOM-based cross-site scripting (XSS), discovering parameters, injecting payloads, and verifying whether they execute. It probes which characters survive in each context, then performs AST-level checks against the parsed DOM instead of treating an echoed string as proof. Each result is graded according to the evidence behind it, helping security practitioners separate confirmed behavior from unverified reflections.

Run it as a command against a single URL, or provide a file containing one target URL per line for batch scanning. Targets can also arrive through standard input, allowing Dalfox to sit after a crawler or reconnaissance pipeline. For stored-XSS testing, it injects at one endpoint and checks the page where the payload later appears; it can also operate as a long-running REST server for asynchronous jobs, integrations, and dashboards. MCP tools expose the same scanning capabilities to agents and IDEs, while every mode uses the shared discovery and verification engine.

Dalfox suits penetration testers, security researchers, and developers assessing parameters during application testing or automated reconnaissance. Published by HAHWUL, it is open-source Security & Privacy software for Linux, delivered as a single binary with automation at its core. The current v3.2.4 release requires Linux with snapd and targets the x86_64 (amd64) architecture.