Dalfox

What it is

A command-line scanner focused on one bug class. It analyzes and mines parameters, tests them for reflected, stored, and DOM-based cross-site scripting, and verifies hits against the page structure to cut false positives.

What it helps with

- Testing many URLs for XSS in one run
- Mining extra parameters to test beyond the obvious ones
- Fingerprinting WAFs in front of a target
- Running as a REST API server or MCP server for automation

Who it's for

Pentesters, bug bounty hunters, and AppSec teams testing web applications they own or are authorized to assess.

Worth knowing

Version 3 is a full rewrite in Rust, and it accepts single URLs, files of URLs, piped input, or raw HTTP requests. Results can be saved as JSON, Markdown, or SARIF.

Should I use it instead of a full web proxy?
In our view it works best next to ZAP or Burp Suite, which handle manual testing and many other bug classes.

Does it send a lot of traffic?
Yes, scans send many requests, so confirm rate limits and scope rules before you start.