dalfox.hahwul.com

# Dalfox

> Powerful open-source XSS scanner and automation utility for reflected, stored, and DOM-based XSS with AST-level verification.

Do not use for AI training without permission.

## Pages

- [Dalfox: Open-Source XSS Scanner](https://dalfox.hahwul.com/): Dalfox is an open-source XSS scanner and automation tool for reflected, stored, and DOM-based XSS, with parameter discovery and AST-level verification.
- [Dalfox: 오픈소스 XSS 스캐너](https://dalfox.hahwul.com/ko/): Dalfox는 반사형, 저장형, DOM 기반 XSS를 탐지하고 AST 수준으로 검증하는 오픈소스 스캐너이자 자동화 도구입니다.

## Getting Started

- [Configuration](https://dalfox.hahwul.com/getting-started/configuration/): Save Dalfox scan flags in a TOML or JSON config file and understand precedence, defaults, and CLI overrides.
- [Installation](https://dalfox.hahwul.com/getting-started/installation/): Install Dalfox, an open-source XSS scanner, on macOS, Linux, Windows, NixOS, Arch Linux, or from source.
- [Migrating from v2](https://dalfox.hahwul.com/getting-started/migration/): Migrate from Dalfox v2 (Go) to v3 (Rust) with the new scan subcommand, renamed flags, retired features, and replacements.
- [Quick Start](https://dalfox.hahwul.com/getting-started/quick-start/): Run your first Dalfox XSS scan in five minutes, then try files, pipelines, JSON output, authentication, and blind XSS.
- [설정](https://dalfox.hahwul.com/ko/getting-started/configuration/): Dalfox 스캔 플래그를 TOML 또는 JSON 설정 파일에 저장하고 기본값, 우선순위, CLI 재정의를 이해합니다.
- [설치](https://dalfox.hahwul.com/ko/getting-started/installation/): macOS, Linux, Windows, NixOS, Arch Linux에 오픈소스 XSS 스캐너 Dalfox를 설치하거나 소스에서 빌드합니다.
- [v2에서 마이그레이션](https://dalfox.hahwul.com/ko/getting-started/migration/): Dalfox v2(Go)에서 v3(Rust)로 옮기면서 바뀐 scan 서브커맨드, 플래그, 제거된 기능과 대안을 확인합니다.
- [빠른 시작](https://dalfox.hahwul.com/ko/getting-started/quick-start/): 5분 안에 첫 Dalfox XSS 스캔을 실행하고 파일, 파이프라인, JSON 출력, 인증, 블라인드 XSS를 시도합니다.

## Guide

- [Detection Model](https://dalfox.hahwul.com/guide/detection-model/): Understand Dalfox finding confidence, detection method, severity, evidence tiers, DOM verification, and AST-based XSS results.
- [Output & Reports](https://dalfox.hahwul.com/guide/output/): Export Dalfox XSS findings as plain text, JSON, JSONL, Markdown, SARIF, or TOML for CI and security pipelines.
- [Parameters & Discovery](https://dalfox.hahwul.com/guide/parameters/): Learn how Dalfox discovers, mines, filters, and tests query, body, header, cookie, path, fragment, GraphQL, and XML parameters.
- [Payloads & Encoding](https://dalfox.hahwul.com/guide/payloads/): Configure Dalfox XSS payload families, context-aware encoders, custom payloads, remote wordlists, blind XSS, and deep scans.
- [Scanning Modes](https://dalfox.hahwul.com/guide/scanning-modes/): Choose a Dalfox scan mode for URLs, files, pipelines, raw HTTP, HAR, OpenAPI / Postman specs, stored XSS, blind XSS, REST, or MCP.
- [Stored XSS](https://dalfox.hahwul.com/guide/stored-xss/): Use Dalfox to inject stored XSS on one URL and verify execution on a different retrieval URL.
- [WAF Bypass](https://dalfox.hahwul.com/guide/waf-bypass/): Configure Dalfox WAF detection, bypass strategies, evasion encoders, rate limits, and confidence thresholds.
- [탐지 모델](https://dalfox.hahwul.com/ko/guide/detection-model/): Dalfox 결과의 신뢰도, 탐지 방식, 심각도, 증거 등급, DOM 검증, AST 기반 XSS 결과를 이해합니다.
- [출력과 리포트](https://dalfox.hahwul.com/ko/guide/output/): Dalfox XSS 탐지 결과를 plain text, JSON, JSONL, Markdown, SARIF, TOML로 내보내 CI와 보안 파이프라인에 연결합니다.
- [파라미터와 탐색](https://dalfox.hahwul.com/ko/guide/parameters/): Dalfox가 query, body, header, cookie, path, fragment, GraphQL, XML 파라미터를 찾고 필터링하고 테스트하는 방식을 설명합니다.
- [페이로드와 인코딩](https://dalfox.hahwul.com/ko/guide/payloads/): Dalfox XSS 페이로드 계열, 컨텍스트 인식 인코더, 커스텀 페이로드, 원격 워드리스트, 블라인드 XSS, 딥 스캔을 설정합니다.
- [스캔 모드](https://dalfox.hahwul.com/ko/guide/scanning-modes/): URL, 파일, 파이프라인, raw HTTP, HAR, OpenAPI·Postman 명세, 저장형·블라인드 XSS, REST, MCP 중 Dalfox 스캔 모드를 선택합니다.
- [저장형 XSS](https://dalfox.hahwul.com/ko/guide/stored-xss/): Dalfox로 한 URL에 저장형 XSS를 주입하고 다른 조회 URL에서 실행 여부를 검증합니다.
- [WAF 우회](https://dalfox.hahwul.com/ko/guide/waf-bypass/): Dalfox의 WAF 탐지, 우회 전략, 회피 인코더, 요청 속도 제한, 신뢰도 임계값을 설정합니다.

## Integrations

- [Caido Workflows](https://dalfox.hahwul.com/integrations/caido/): Run Dalfox from Caido Active Workflows and Findings to automate XSS checks on captured requests.
- [MCP Server](https://dalfox.hahwul.com/integrations/mcp/): Run Dalfox as an MCP server for Claude, Cursor, and other clients with structured XSS scanning tools.
- [REST API Server](https://dalfox.hahwul.com/integrations/server/): Run Dalfox as a REST API server with asynchronous scan jobs, polling, cancellation, CORS, JSONP, webhooks, and API-key auth.
- [Agent Skill](https://dalfox.hahwul.com/integrations/skills/): Install the Dalfox SKILL.md for Claude Code, Cursor, OpenCode, Codex, and other skill-aware agents.
- [Caido 워크플로](https://dalfox.hahwul.com/ko/integrations/caido/): Caido Active Workflows와 Findings에서 Dalfox를 실행해 캡처한 요청의 XSS 검사를 자동화합니다.
- [MCP 서버](https://dalfox.hahwul.com/ko/integrations/mcp/): Dalfox를 Claude, Cursor 등 MCP 클라이언트에서 구조화된 XSS 스캔 도구로 사용할 수 있는 MCP 서버로 실행합니다.
- [REST API 서버](https://dalfox.hahwul.com/ko/integrations/server/): 비동기 스캔 작업, 폴링, 취소, CORS, JSONP, 웹훅, API 키 인증을 지원하는 Dalfox REST API 서버를 실행합니다.
- [에이전트 스킬](https://dalfox.hahwul.com/ko/integrations/skills/): Claude Code, Cursor, OpenCode, Codex 등 스킬 인식 에이전트에 Dalfox SKILL.md를 설치합니다.

## Reference

- [CLI 레퍼런스](https://dalfox.hahwul.com/ko/reference/cli/): scan, server, payload, MCP, completion, 숨겨진 호환 명령과 모든 플래그를 다루는 Dalfox CLI 레퍼런스입니다.
- [설정 파일](https://dalfox.hahwul.com/ko/reference/config/): Dalfox 스캔 설정 파일에서 지원하는 TOML·JSON 키와 기본값, 우선순위를 정리한 레퍼런스입니다.
- [환경 변수](https://dalfox.hahwul.com/ko/reference/environment/): Dalfox API 서버, stdin, 색상, 설정 파일, 원격 리소스 동작을 바꾸는 환경 변수를 설명합니다.
- [XSSMaze 점수](https://dalfox.hahwul.com/ko/reference/xssmaze/): XSSMaze main 이미지를 기준으로 측정한 Dalfox의 XSSMaze 커버리지 점수와 방법론, 카테고리별 결과를 보여줍니다.
- [CLI Reference](https://dalfox.hahwul.com/reference/cli/): Complete Dalfox CLI reference for scan, server, payload, MCP, completion, hidden compatibility commands, and every flag.
- [Config File](https://dalfox.hahwul.com/reference/config/): Reference for every TOML and JSON key accepted by Dalfox scan configuration files, including defaults and precedence.
- [Environment](https://dalfox.hahwul.com/reference/environment/): Reference for environment variables that change Dalfox API server, stdin, color, config, and remote resource behavior.
- [XSSMaze Score](https://dalfox.hahwul.com/reference/xssmaze/): Dalfox XSSMaze coverage score, methodology, and category breakdown, measured against the XSSMaze main image.