DalFox is just XSS Scanning and Parameter Analysis tool. I previously developed XSpear, a ruby-based XSS tool, and this time, a full change occurred during the process of porting with golang!!! and created it as a new project. The basic concept is to analyze parameters, find XSS, and verify them based on DOM Parser.
I talk about naming. Dal(달) is the Korean pronunciation of moon and fox was made into Fox(Find Of XSS).
Key Features
Also Read – Shellerator : CLI Tool For The Generation Of Bind & Reverse Shell
How To Install?
There are a total of three ways to Personally, I recommend go install.
Developer version (go-get or go-install)
go-install
$ git clone https://github.com/hahwul/dalfox
$ go install
$ ~/go/bin/dalfox
go-get
$ go get -u github.com/hahwul/dalfox
$ ~/go/bin/dalfox
Release Version
$ cp dalfox /usr/bin/
Usage
Parameter Analysis and XSS Scanning tool based on golang
Finder Of XSS and Dal is the Korean pronunciation of moon. @hahwul
Usage:
dalfox [command]
Available Commands:
– file Use file mode(targets list or rawdata)
– help Help about any command
– pipe Use pipeline mode
– sxss Use Stored XSS mode
– update Update DalFox (Binary patch)
– url Use single target mode
– version Show version
Flags:
-b, –blind string Add your blind xss (e.g -b hahwul.xss.ht)
–config string Using config from file
-C, –cookie string Add custom cookie
–custom-payload string Add custom payloads from file
-d, –data string Using POST Method and add Body data
–delay int Milliseconds between send to same host (1000==1s)
–found-action string If found weak/vuln, action(cmd) to next
–grep string Using custom grepping file (e.g –grep ./samples/sample_grep.json)
-H, –header string Add custom headers
-h, –help help for dalfox
–ignore-return string Ignore scanning from return code (e.g –ignore-return 302,403,404)
–only-discovery Only testing parameter analysis
-o, –output string Write to output file
–output-format string -o/–output ‘s format (txt/json/xml)
-p, –param string Only testing selected parameters
–proxy string Send all request to proxy server (e.g –proxy http://127.0.0.1:8080)
–silence Not printing all logs
–timeout int Second of timeout (default 10)
–user-agent string Add custom UserAgent
-w, –worker int Number of worker (default 40)
$ dalfox [mode] [flags]
Single target mode
$ dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://hahwul.xss.ht
Multiple target mode from file
$ dalfox file urls_file –custom-payload ./mypayloads.txt
Pipeline mode
$ cat urls_file | dalfox pipe -H “AuthToken: bbadsfkasdfadsf87”
Other tips, See wiki for detailed instructions!
ScreenShot
This repository contains tools created by yogSahare0 while learning Python 3 for ethical hacking and penetration testing.…
"NetSecChallenger" provides a suite of automated tools designed for security professionals and network administrators to…
The essential tool for cybersecurity enthusiasts! This guide provides a detailed walkthrough on how to…
Meet "Poodone," the ultimate Python script designed for cybersecurity enthusiasts and professionals alike. Packed with…
The Linux version is no longer supported! The last Linux version is 6.0 that you…
Jin is a hacking command-line tools designed to make your scan port, gathering urls, check…