Dalfox Cheat Sheet: Every Flag I Actually Use

dalfox is the XSS scanner I reach for first. It is fast, scriptable, and reads from stdin which makes it slot cleanly into a recon pipeline. This is the field reference for the flags that matter, grouped by the task I am trying to accomplish.

Heads-up on v3. Dalfox v3.0.0 (released 2026-05-25) is a complete Rust rewrite. The Go v2 codebase is preserved on the v2 branch for security backports. The most visible change: v2's url, file, pipe, sxss, and server subcommands are gone. v3 has four subcommands (scan, server, payload, mcp) and scan auto-detects the input shape (URL, file, stdin, raw HTTP). Every example below uses the v3 surface.

If you are new to Dalfox, the Dalfox tutorial walking through an attack against a vulnerable app is the right next stop. If you are comparing tools, the best XSS tools list for 2026 covers the alternatives. For the underlying mechanics, the cross-site scripting deep dive has the full taxonomy, with separate writeups on reflected XSS and DOM-based XSS.

Quick reference

What a raw HTTP request file looks like

req.txt is a raw HTTP request: method line, headers, blank line, body. When the endpoint needs auth, custom headers, or a non-trivial POST body, -i raw-http req.txt is faster than packing every flag manually. Here is what it actually looks like:

GET /search?q=test HTTP/1.1
Host: target.example
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9
Cookie: session=eyJhbGciOiJIUzI1NiJ9...; PHPSESSID=q9k2...
Connection: close

POST requests look the same with the method and body added:

POST /comment HTTP/1.1
Host: target.example
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 21
Cookie: PHPSESSID=q9k2...
Connection: close

body=hello&author=me

Dalfox tests every parameter it finds in the request unless you restrict with --param. No special markers required.

Capturing it from Chrome or Firefox

1. Open DevTools (F12 on Windows/Linux, Cmd+Option+I on macOS), Network tab, enable Preserve log.
2. Trigger the target request in the page.
3. Right-click the request, Copy as cURL. Paste into a converter (curlconverter --language http <command> from npm) to get raw HTTP, or hand-translate: -H "Foo: bar" becomes a header line, --data 'x=y' becomes the body.
4. Save as req.txt. Use with dalfox scan -i raw-http req.txt in every example below.

Workflow templates

A few command lines I use as starting points and adapt from.

Simplest possible probe, just a URL with a query string. Good for a first sanity check:

dalfox scan ':target_url' --workers :workers --delay :delay --timeout :timeout --user-agent ':ua'

POST request with form data, no req.txt needed:

dalfox scan 'https://target.example/comment' \
     -X POST -d 'body=hello&author=me' \
     --workers :workers --delay :delay --user-agent ':ua'

Captured request, light touch, see if anything reflects:

dalfox scan -i raw-http req.txt --workers :workers --delay :delay --timeout :timeout

Authenticated, scoped to specific parameters:

dalfox scan -i raw-http req.txt -p 'q:query' -p 'filter:query' \
     --workers :workers --delay :delay \
     --skip-mining --user-agent ':ua'

Behind a WAF, slow and quiet:

dalfox scan -i raw-http req.txt --workers 5 --delay 500 --waf-evasion \
     --custom-payload evasion.txt --user-agent ':ua'

Blind XSS run with an interactsh callback:

dalfox scan -i raw-http req.txt -b ':blind' \
     --workers :workers --delay :delay --user-agent ':ua'

The pipeline I use most, kxss as a reflection pre-filter so Dalfox only spends payload budget on endpoints that actually echo input:

echo target.example | gau | kxss | awk '{print $NF}' \
  | dalfox scan --silence -f jsonl -o findings.jsonl

Full recon chain from a single root domain to confirmed XSS, end to end:

subfinder -d target.example -silent \
  | httpx -silent \
  | katana -silent \
  | dalfox scan --silence -f jsonl -o findings.jsonl

Stored XSS workflow: send payloads to the profile endpoint, check for reflection on the public view page (v3 replaces dalfox sxss with --sxss):

dalfox scan 'https://target.example/profile/edit' \
     --sxss --sxss-url 'https://target.example/profile/view' \
     --cookies 'session=abc' \
     --workers :workers --delay :delay

--silence and -f jsonl are the two flags that matter most for pipeline use. Without them, banner noise and progress spinners corrupt the output stream.

v2 → v3 migration cheat sheet

If you have v2 muscle memory, the most common substitutions:

Flags I almost never use

• --config (the TOML/JSON config file) if you only scan ad-hoc targets. Useful when the same scope reappears weekly.
• --include-request --include-response in fast scans; the output balloons quickly. Enable only when triaging a specific finding.
• --only-discovery on its own; --skip-xss-scanning reads more clearly to anyone else reading the run script.

A note on responsible use

Every flag above is dual use. The same blind callback that catches an admin's session in your bug bounty target is the one I run against my own lab apps weekly. Use these against systems you own or are explicitly authorised to test. See the legal-framing notes in the cross-site scripting deep dive.