1. Conduid
  2. Security
  3. Dalfox
MCP server Β· Security

Dalfox

Β· github.com/hahwul/dalfox

πŸŒ™πŸ¦Š Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Unclaimed bugbountybugbounty-tooldevsecopshacktoberfestrustsecurityxssxss-scanner
InstallView source
64Good

Scored 5 months ago Β· breakdown

About Dalfox

Dalfox is an MCP server in the Security category: πŸŒ™πŸ¦Š Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Install

From source
git clone https://github.com/hahwul/dalfox

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Dalfox

Powered by Claude · Grounded in docs

I know everything about Dalfox. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • βœ“README presentThe repository ships documentation.

5 checks have not been run yet.

README

Looking for the Go (v2.x) version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy.

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities.

Key features

  • Subcommands: scan (URL / file / pipe / raw-HTTP, auto-detected), server, payload, mcp
  • Discovery: Parameter analysis, static analysis, BAV testing, parameter mining
  • XSS Scanning: Reflected, Stored (SXSS), DOM-based, with optimization and DOM/AST verification
  • WAF: Fingerprinting with confidence scoring, bypass tracking, and tunable --waf-min-confidence
  • HTTP Options: Custom headers, cookies, methods, proxy, and more
  • Output: JSON/JSONL/Plain/Markdown/SARIF/TOML formats, silence mode, detailed reports
  • Extensibility: REST API, MCP stdio server, custom payloads, remote wordlists

And the various options required for the testing :D

Installation

Homebrew (macOS/Linux)

brew install dalfox

# https://formulae.brew.sh/formula/dalfox

Snapcraft (Ubuntu)

sudo snap install dalfox

Nixpkgs (NixOS)

A package is available for Nix or NixOS users. Keep in mind that the latest releases might only be present in the unstable channel.

nix-shell -p dalfox

Nix Flakes

For Nix users with flakes enabled:

# Run directly
nix run github:hahwul/dalfox -- scan https://example.com

# Install
nix profile install github:hahwul/dalfox

# Development environment
nix develop github:hahwul/dalfox

See Installation guide for details.

Usage

dalfox [mode] [target] [flags]
  • Single URL: dalfox url http://example.com -b https://callback
  • File Mode: dalfox file urls.txt --custom-payload mypayloads.txt
  • Pipeline: cat urls.txt | dalfox pipe -H "AuthToken: xxx"

Check the Usage and Running documents for more examples.

Contributing

if you want to contribute to this project, please see CONTRIBUTING.md and Pull-Request with cool your contents.

About the Name

As for the name, Dal(달) is the Korean word for "moon," while "Fox" stands for "Finder Of XSS" or 🦊

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About Dalfox

How do I install Dalfox?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Dalfox safe to use with an AI agent?

Its trust score is 64 out of 100 (good). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Dalfox still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.