hahwul/dalfox

This system is Dalfox v3, a high-performance web vulnerability scanner rewritten in Rust that detects XSS, blind vulnerabilities, and WAF interactions. It features a modular architecture for parameter discovery, payload generation, and AST-based DOM analysis, supporting both CLI and programmatic interfaces via REST and MCP. The tool includes robust configuration management, comprehensive output formatting, and hardened security controls for its server components.

16 changes.

This period focused on the foundational scaffolding and core module implementation for the Dalfox v3 Rust rewrite, introducing advanced scanning capabilities such as AST-based DOM XSS detection, active parameter analysis, and comprehensive payload generation. The work also established robust infrastructure for configuration management, error handling, and agent integration via MCP, while significantly hardening the codebase against denial-of-service vectors and input parsing failures. Extensive test coverage was added across unit, functional, and end-to-end levels to validate these new features and ensure stability.

10 changes.

This period focused on expanding the scanner's capabilities with new modules for WAF fingerprinting, bypass strategies, and out-of-band interaction detection. Significant architectural improvements were made to parameter discovery and mining, introducing modular surfaces and adaptive probing to reduce redundant requests and false positives. Concurrently, the project hardened its HTTP API security, unified job lifecycle management, and established robust testing and packaging infrastructure.

This change introduces the PKGBUILD for the Arch User Repository, packaging Dalfox version 3.2.3. The build process disables Link Time Optimization (LTO) to prevent linking failures with the \ring\ crate. The package installs the binary along with man pages and shell completions for Bash, Zsh, and Fish, which are generated at build time rather than shipped in the source tree.

aur · high confidence

The scanning module now includes a new AST-based analysis engine to detect DOM-based XSS vulnerabilities. This engine parses JavaScript source code into an Abstract Syntax Tree and performs taint analysis to track data flow from untrusted sources (such as URL parameters, event handlers, and DOM attributes) to dangerous sinks (such as innerHTML, eval, and dynamic script execution). The implementation includes robust safeguards against parser stack overflows from deeply nested or maliciously crafted scripts, ensuring the scanner remains stable during analysis.

src/scanning · high confidence

Dalfox now supports loading scan settings from a configuration file (TOML or JSON) located in the XDG config directory or a user-specified path via the new \--config\ flag. The configuration system automatically creates a default TOML template if none exists and allows users to predefine most scan flags. Crucially, the implementation enforces strict precedence: explicitly provided CLI flags always override values in the configuration file, preventing config files from unintentionally overriding user intent.

src · high confidence

Adds a new suite of end-to-end testing and benchmarking scripts written in Crystal to the \scripts/\ directory. This includes harnesses for measuring detection effectiveness against a labelled corpus, performing A/B binary diffs to catch regression in findings, linting documentation for structural integrity, and running hostile scans to ensure the scanner remains stable under adversarial conditions. The change also adds a collection of HTML replay fixtures designed to verify that the scanner correctly identifies benign reflection patterns as safe.

scripts · high confidence

Adds a new OOB client module (\src/oob/interactsh\) that implements the Interactsh protocol for detecting blind vulnerabilities. This includes RSA-2048 key generation, secure registration with OAST servers, and polling for interactions using AES-256-CTR decryption. The implementation also ensures that OOB requests bypass the environment's HTTP proxy to prevent silent failures or interception issues.

src/oob/interactsh · high confidence

A new \src/waf/bypass\ module introduces a structured system for evading Web Application Firewalls. It defines a vocabulary of payload mutations (such as HTML comment splitting, whitespace substitution, backtick parentheses, and entity encoding) and maps specific combinations of these mutations to detected WAF types (e.g., Cloudflare, ModSecurity, OWASP CRS). The module also adds telemetry to track bypass effectiveness per target, allowing the scanner to attribute success or failure to specific mutation techniques.

src/waf/bypass · high confidence

The \src/waf\ module introduces a new capability to detect Web Application Firewalls by analyzing HTTP response headers and body content. Detection logic is driven by \src/waf/rules.toml\, which defines header and body patterns for 18 specific WAF vendors (including Cloudflare, AWS WAF, Akamai, ModSecurity, OWASP CRS, Citrix NetScaler, Wallarm, NAXSI, and SafeLine) along with their confidence scores. The module includes a \fingerprint\_from\_response\ function that aggregates these signals, and a \fingerprint\_with\_probe\ function that sends a probe request mirroring the target's method and body to improve detection accuracy for POST targets. Tests verify that the rules file loads correctly and that probes preserve authentication cookies and method semantics.

src/waf · high confidence

The \src/parameter\_analysis\ module has been introduced to orchestrate the full parameter analysis pipeline (Discovery, Mining, and Active Probing). This change adds active probing capabilities that confirm special character reflection and refine injection contexts, including support for pre-encoding detection (e.g., base64) and escaped special characters. It also introduces specific location support for GraphQL and XML bodies, with a dedicated XML injection tokenizer that identifies injectable text nodes and attribute values in SOAP/XML requests. The module includes comprehensive tests for parameter analysis, mining, and cookie handling.

_src/parameter\analysis · high confidence

The payload module now includes several new capabilities: a gadget database for CSP bypass payloads (gadget\_db.rs) that supports both host-allowlist and strict-dynamic bypasses; a JavaScript breakout computation engine (js\_breakout.rs) that calculates exact closer sequences for nested script contexts; a parameter mining module (mining.rs) with curated wordlists from Gf-Patterns and Gori Param Miner; and a remote provider system (remote.rs) that allows fetching payloads and wordlists from external sources with caching and registration APIs. These changes enhance XSS detection coverage, particularly for complex injection contexts and CSP bypass scenarios.

src/payload · high confidence

The repository now contains the foundational structure for the Dalfox v3 Rust rewrite, including the Cargo project files, a multi-stage Dockerfile, and a Nix flake for reproducible builds and development environments. A new AGENTS.md file documents the project architecture, behavioral invariants, and change guidelines for coding agents, while the README has been updated to reflect the new Rust-based tooling, installation methods (Homebrew, Snap, Nix), and the availability of the legacy Go v2 branch.

(repo-wide) · high confidence

Users can now import scan targets directly from HAR (HTTP Archive) files exported by browser dev tools and intercepting proxies, restoring a capability lost in the previous version. The target parser also rejects non-HTTP(S) URL schemes (such as \ftp://\ or \ws://\) with a clear error instead of silently mangling them, and it now strips unsendable headers from raw HTTP and HAR imports to prevent requests from failing. Additionally, the HTTP client is now cached and reused across targets based on configuration (timeout, proxy, TLS settings), which reduces connection overhead and improves scanning performance.

_src/target\parser · high confidence

The server now enforces robust security boundaries for its HTTP API. It introduces API-key authentication using constant-time comparison to prevent timing attacks, and adds strict cross-site request protection by validating the \Origin\ and \Sec-Fetch-Site\ headers to block browser-driven attacks. DNS rebinding is mitigated by validating the \Host\ header against an allow-list. Additionally, all API responses now include \X-Content-Type-Options: nosniff\ and \Cache-Control: no-store\ headers to prevent MIME sniffing and accidental caching of sensitive scan results.

src/server · high confidence

The encoding module now supports additional payload transformations—specifically HTML entity zero-padding, Unicode fullwidth, and zero-width space encoders—alongside existing URL and base64 variants. To prevent the preflight request estimates (used by --dry-run, the REST /preflight endpoint, and the MCP tool) from underestimating scan volume, the \encoder\_expansion\_factor\ helper has been centralized and synchronized with the actual encoder expansion logic, ensuring that all newly added encoders correctly contribute to the estimated total requests.

src/encoding · high confidence

The MCP server implementation has been restructured to improve reliability and agent usability. It now uses structured tool outputs with JSON schemas derived from Rust types to prevent API drift, and enforces strict parameter validation to prevent silent failures. The server supports real-time progress streaming via MCP notifications for long-running scans, allows clients to cancel in-flight scans using cancellation tokens, and includes pagination for large result sets. Additionally, it introduces prompts for guided workflows and adds a provenance notice to warn agents about untrusted content from scan targets.

src/mcp · high confidence

The parameter discovery phase has been restructured into dedicated modules (cookie, form, fragment, header, path, query) to improve clarity and maintainability. This change introduces specific discovery logic for each parameter location: cookies are now probed with support for explicit injection points and reflection skipping; forms are parsed from HTML responses with a cap on field count to prevent quadratic probing costs; URL hash fragments are extracted for client-side DOM-XSS correlation; headers include a differential probe to detect and skip 'blanket echo' endpoints; and path segments are discovered with a two-step verification to avoid wasting requests on error pages that only echo URLs in attributes. A new deduplication step merges duplicate parameters discovered across these surfaces (e.g., a query param also present in a form) to reduce redundant scanning.

_src/parameter\analysis/discovery · high confidence

The \src/utils\ directory now includes several new modules that harden the scanner against denial-of-service and improve request consistency. \fs.rs\ introduces bounded file and stdin readers with a 256 MiB hard cap to prevent memory exhaustion from large or streaming inputs, and adds a grace-window mechanism to avoid hanging on idle stdin pipes. \html.rs\ implements a nesting-depth guard (capped at 512 levels) for HTML parsing to prevent quadratic-time hangs on deeply nested documents. \http.rs\ centralizes HTTP request building, ensuring consistent header, User-Agent, and Cookie handling, and enforces same-origin checks (with a controlled HTTP-to-HTTPS upgrade relaxation) for form actions to prevent credential leakage. \banner.rs\ provides a reusable, color-aware ASCII banner renderer. \log.rs\ unifies debug logging into a single stderr macro and adds log-injection sanitization. \mod.rs\ re-exports these helpers and adds stable per-finding fingerprints for SARIF deduplication.

src/utils · high confidence

The parameter mining stage has been refactored to significantly reduce outbound requests and improve accuracy. It now groups candidate parameter names into bounded buckets (default 64 per request) to identify reflections and metric-only changes in single responses, rather than one request per name. Additionally, an EWMA-based collapse mechanism detects pages that echo arbitrary input; when triggered, it consolidates mined parameters into a synthetic 'any' param to stop wasting probes on redundant injection points. The system also introduces slot-scoped deduplication, ensuring that parameters with the same name but different locations (e.g., query vs. body) are not incorrectly suppressed, and caps DOM-extracted candidates to prevent excessive fan-out on hostile responses.

_src/parameter\analysis/mining · high confidence

The CLI subcommands for file, pipe, and payload inputs have been refactored to use a shared ScanArgs structure, ensuring consistent argument handling and explicit input-type precedence over config files. Additionally, a unified set of application-level error codes (e.g., SESSION\_LOST, INTERNAL\_ERROR, INPUT\_TOO\_LARGE) has been introduced across CLI, REST API, and MCP interfaces to provide consistent, machine-readable error reporting in JSON output, replacing previous silent failures or ambiguous exit codes.

src/cmd · high confidence

The \src/job\ module now provides a single, shared implementation for managing asynchronous scan jobs, replacing the previous duplicated logic in the REST server and MCP runtime. This change introduces strict input validation at the API boundary to prevent silent failures: proxy URLs are now validated for routability (rejecting schemes like \ftp://\), HTTP headers and User-Agent values are checked against \reqwest\ constraints to avoid connection failures, and payload encoders are verified against the canonical CLI list to ensure full payload coverage. The scan execution core enforces resource safety with configurable ceilings for discovered parameters (512), payloads per parameter (100,000), and active scans (100 for MCP), while also implementing a whole-scan wall-clock budget and per-job rate limiting. Terminal jobs are automatically purged after one hour to prevent unbounded memory growth, and job status serialization is standardized to lowercase JSON strings to ensure consistency between REST/MCP clients and CLI logs.

src/job · high confidence

Added E2E smoke tests for CLI and config handling; Added functional test coverage for DOM XSS, external JS analysis, and deep-scan preflight; Added integration tests for agent skill sync, JS breakout, and remote payload caching; Added integration tests for markdown and SARIF output formats; Added tests for encoding pipeline and nested parameter inference; Added unit tests for encoding, target parsing, and utility functions.

This release updates the project's dependency tree and generates a new Cargo.lock file. Key version bumps include oxc crates to 0.133.0, aes to 0.9.3, ctr to 0.10.1, reqwest to 0.13.5, and rmcp to 3.4.1. The Cargo.toml also reflects the package version 3.2.3, the Rust edition 2024, and an MSRV of 1.93.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 71 → 72 (+1.1)
• Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

• Code Health 70 → 71 (+0.7)
• Architecture 96 → 98 (+1.7)
• Maturity 65 → 65 (-0.1)
• Readiness 83 → 82 (-0.3)
• Security 75 → 81 (+6.3)
• Performance 100 (new)

• Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
• Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
• Change coupling: mutate.rs ↔ mod.rs (src/waf/bypass/mutate.rs)
• Duplicated block (10 lines × 2) (src/scanning/js_context_verify.rs)
• Duplicated block (10 lines × 3) (src/parameter_analysis/discovery/form.rs)
• Duplicated block (11 lines × 3) (src/scanning/url_inject.rs)
• Duplicated block (12 lines × 2) (src/utils/fs.rs)
• Duplicated block (12 lines × 3) (src/scanning/url_inject.rs)
• Duplicated block (12 lines × 7) (src/parameter_analysis/discovery/cookie.rs)
• Duplicated block (13 lines × 2) (src/cmd/scan/input.rs)
• Duplicated block (13 lines × 3) (src/scanning/url_inject.rs)
• Duplicated block (17 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
• Duplicated block (18 lines × 2) (src/parameter_analysis/mining/probe_body.rs)
• Duplicated block (18–19 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
• Duplicated block (20 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
• Duplicated block (20–25 lines × 2) (src/parameter_analysis/mining/probe_dictionary.rs)
• Duplicated block (21–24 lines × 2) (src/scanning/check_dom_verification.rs)
• Duplicated block (32–33 lines × 2) (src/mcp/mod.rs)
• Duplicated block (37–39 lines × 2) (src/mcp/mod.rs)
• Duplicated block (8–9 lines × 6) (src/parameter_analysis/discovery/cookie.rs)
• …and 30 more

• Boundary-crossing change coupling: tests.rs ↔ tests.rs (src/parameter_analysis/discovery/tests.rs)
• Duplicated block (10 lines × 2) (src/scanning/url_inject.rs)
• Duplicated block (11 lines × 3) (src/scanning/ast_dom_analysis/sinks.rs)
• Duplicated block (12 lines × 2) (src/utils/fs.rs)
• Duplicated block (13–14 lines × 3) (src/parameter_analysis/discovery/cookie.rs)
• Duplicated block (14 lines × 3) (src/scanning/ast_dom_analysis/sinks.rs)
• Duplicated block (15–16 lines × 2) (src/scanning/ast_dom_analysis/sinks.rs)
• Duplicated block (17 lines × 2) (src/scanning/ast_integration.rs)
• Duplicated block (22–27 lines × 2) (src/scanning/check_dom_verification.rs)
• Duplicated block (24–25 lines × 2) (src/mcp/mod.rs)
• Duplicated block (6 lines × 2) (src/scanning/ast_dom_analysis/sinks.rs)
• Duplicated block (6 lines × 2) (src/utils/xml.rs)
• Duplicated block (6 lines × 2) (src/utils/xml.rs)
• Duplicated block (7 lines × 2) (src/scanning/check_reflection.rs)
• Duplicated block (7 lines × 2) (src/scanning/url_inject.rs)
• Duplicated block (7 lines × 2) (src/utils/log.rs)
• Duplicated block (8–12 lines × 3) (src/scanning/check_dom_verification.rs)
• Duplicated block (9 lines × 2) (src/parameter_analysis/discovery/form.rs)
• Duplicated block (9 lines × 2) (src/scanning/check_dom_verification.rs)
• Duplicated block (9 lines × 2) (src/scanning/url_inject.rs)
• …and 42 more

• 50 commits — 29 feature/other, 21 fixes

• (root) — 10 commits
• src/scanning — 10 commits
• docs/content — 6 commits
• src/cmd — 6 commits
• src/parameter_analysis — 5 commits
• .github/workflows — 3 commits
• src/mcp — 3 commits
• docs/static — 2 commits
• (repo) — 1 commit
• src/encoding — 1 commit
• src/job — 1 commit
• src/payload — 1 commit
• tests/functional — 1 commit

• fix: Fix parameter discovery and request injection edge cases (#1484)
• fix: Publish structured MCP tool output and fix the server's own identity (#1466)
• fix: fix(dom-verify): false [V] on inert JS-string / data-block reflections, numeric A findings (#1478)
• fix: fix(encoding): send multi-URL pre-encoded path params with the probed layer count (#1479)
• fix: fix(http): honor request pacing and user-agent overrides (#1487)
• fix: fix(jobs): align reachability probes with CLI (#1491)
• fix: fix(mcp): protect draining jobs from deletion (#1474)
• fix: fix(output): preserve markdown fields and type descriptions (#1483)
• fix: fix(payload): repair generated HTML/attr payloads that could never DOM-verify (#1475)
• fix: fix(poc): make PoCs reproduce the request the scan actually sent (#1477)
• fix: fix(scan): preserve incomplete results and resume state (#1485)
• fix: fix(scanner): gate XSS findings by response content type (#1494)
• fix: fix(scanner): preserve URL semantics during injection (#1480)
• fix: fix(scanner): preserve payload selection and valid WAF variants (#1490)
• fix: fix(sxss): find and correctly attribute form-backed stored sinks (#1493)
• fix: fix: CSP meta/report-only precedence and WAF status misdetection (#1481)
• fix: fix: HPP form-action/pre-encoding drift and streamed AST duplicates (#1488)
• fix: fix: bug-hunt batch — blind XSS request builders, batch-mining attribution, server/MCP parity, and CLI silent-clean holes (#1476)
• fix: fix: follow a form action's same-host TLS upgrade (#1461)
• fix: fix: multi-policy CSP, quoted '>' in script tags, template-literal delimiter, credential-rotation resume, assigned-over parseInt (#1486)
• …and 30 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

hahwul/dalfox was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.