Find and verify XSS across a list of URLs and parameters

dalfox does two jobs most setups split across separate tools: it mines a target for parameters, then tests each one for cross-site scripting. A Go-based DOM parser drives the analysis, so it tracks where a value lands in the page, whether that is the HTML body, an attribute, inside a script, or a DOM sink, and it sends only the payloads that can execute in that context. The headless engine then loads the response and confirms whether the injection fired, so reflected noise stays out of the results.

It is built to run unattended. Point it at a single URL, a file of targets, or a raw Burp or ZAP request, and switch modes as the job needs: stored-XSS mode with a --trigger URL, a --blind callback domain for payloads that fire out of band, or remote payload sets from PortSwigger and PayloadBox. Set --report-format to plain, json, or jsonl, and --found-action runs a command on every confirmed hit.

In a Trickest pipeline, dalfox sits after URL collection. Feed it the parameterized links a crawler or gau gathered, let it mine parameters and verify XSS, and route the confirmed findings straight into triage. Because it reads a target list and emits structured output, a scheduled run turns fresh URLs into fresh XSS findings with no manual step in between.