DalFox - Finder of XSS, and Dal is the Korean pronunciation of the moon.
What is DalFox
Just, XSS scanning and parameter analysis tool. I previously developed XSpear, a ruby-based XSS tool, and this time, a full change occurred during the process of porting with golang!!! and created it as a new project. The basic concept is to analyze parameters, find XSS, and verify them based on DOM Parser.
I talk about naming. Dal(달) is the Korean pronunciation of moon and fox was made into Fox(Find Of XSS).
- Parameter Analysis (find the reflected parameter, find free/bad characters, Identification of injection point)
- Static Analysis (Check Bad-header like CSP, X-Frame-optiopns, etc.. with base request/response base)
- Optimization query of payloads
- Check the injection point through abstraction and generated the fit payload.
- Eliminate unnecessary payloads based on badchar
- XSS Scanning and DOM Base Verifying
- All test payloads(build-in, your custom/blind) are tested in parallel with the encoder.
- Support to Double URL Encoder
- Support to HTML Hex Encoder
- Friendly Pipeline (single URL, from a file, from IO)
- And the various options required for the testing :D
- built-in/custom grepping to find other vulnerability
- if you found, after action
How to Install
There are a total of three ways to. Personally, I recommend go-install.
Developer version (go-get or go-install)
- clone this repo
$ git clone https://github.com/hahwul/dalfox
- install in cloned dalfox path
$ go install
- using dalfox
- go get dalfox!
$ go get -u github.com/hahwul/dalfox
- using dalfox
- Open latest release page https://github.com/hahwul/dalfox/releases/latest
- Download file Download and extract the file that fits your OS.
- You can put it in the execution directory and use it. e.g
$ cp dalfox /usr/bin/
_..._ .' .::::. __ _ _ ___ _ __ __ : :::::::: | \ / \ | | | __/ \\ V / : :::::::: | o ) o || |_ | _( o )) ( '. '::::::' |__/|_n_||___||_| \_//_n_\ '-.::'' Parameter Analysis and XSS Scanning tool based on golang Finder Of XSS and Dal is the Korean pronunciation of moon. @hahwul Usage: dalfox [command] Available Commands: file Use file mode(targets list or rawdata) help Help about any command pipe Use pipeline mode url Use single target mode version Show version Flags: -b, --blind string Add your blind xss (e.g -b https://hahwul.xss.ht) --config string Using config from file -C, --cookie string Add custom cookie --custom-payload string Add custom payloads from file -d, --data string Using POST Method and add Body data --delay int Milliseconds between send to same host (1000==1s) --found-action string If found weak/vuln, action(cmd) to next --grep string Using custom grepping file (e.g --grep ./samples/sample_grep.json) -H, --header string Add custom headers -h, --help help for dalfox --only-discovery Only testing parameter analysis -o, --output string Write to output file --output-format string -o/--output 's format (txt/json/xml) -p, --param string Only testing selected parameters --proxy string Send all request to proxy server (e.g --proxy http://127.0.0.1:8080) --silence Not printing all logs --timeout int Second of timeout (default 10) --user-agent string Add custom UserAgent -w, --worker int Number of worker (default 40)
$ dalfox [mode] [flags]
Single target mode
$ dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://hahwul.xss.ht
Multiple target mode from file
$ dalfox file urls_file --custom-payload ./mypayloads.txt
$ cat urls_file | dalfox pipe -H "AuthToken: bbadsfkasdfadsf87"
Other tips, See wiki for detailed instructions!
- Hakin9 is a monthly magazine dedicated to hacking and cybersecurity. In every edition, we try to focus on different approaches to show various techniques - defensive and offensive. This knowledge will help you understand how most popular attacks are performed and how to protect your data from them. Our tutorials, case studies and online courses will prepare you for the upcoming, potential threats in the cyber security world. We collaborate with many individuals and universities and public institutions, but also with companies such as Xento Systems, CATO Networks, EY, CIPHER Intelligence LAB, redBorder, TSG, and others.
- Blog2022.12.13What are the Common Security Weaknesses of Cloud Based Networks?
- Blog2022.10.12Vulnerability management with Wazuh open source XDR
- Blog2022.08.29Deception Technologies: Improving Incident Detection and Response by Alex Vakulov
- Blog2022.08.25Exploring the Heightened Importance of Cybersecurity in Mobile App Development by Jeff Kalwerisky