GETROBARB

GETROBARB XSS Scanner는 Bash로 작성된 자동화된 XSSCross-Site Scripting 취약점 인식 및 탐지 프레임워크로, 승인된 웹 보안 감사를 위해 설계되었습니다. 버그 바운티 및 침투 테스트 생태계의 여러 인기 유틸리티를 통합하여 취약한 엔드포인트 발견 과정 전체를 자동화합니다. 도구 설명: GETROBARB XSS Scanner GETROBARB XSS Scanner Framework는 여러 공격적 보안 유틸리티를 결합하여 웹 애플리케이션에서 잠재적인 Cross-Site ScriptingXSS...

burpfox

🦊 BurpFox 워크플로우에 Dalfox XSS 스캐너를 직접 통합하는 Burp Suite 확장 프로그램입니다. Features 🎯 우클릭 스캔 - 프록시 기록 또는 Repeater에서 직접 요청을 스캔합니다. ⚙️ 모든 Dalfox 옵션 - 컨텍스트 인식, WAF 우회, Blind XSS 등 Prerequisites 1. Dalfox 설치 BurpFox를 사용하기 전에 시스템에 Dalfox를 설치해야 합니다. macOS Homebrew: root@kitploit: brew install dalfox Linux Go:...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy. Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickl...

dalfox

Cerchi la versione Go v2.x? Dalfox v3 è una riscrittura completa in Rust. Il codice Go è conservato nel ramo v2 e continua a ricevere backport di sicurezza. Consulta SECURITY.md per la policy di supporto. Dalfox è un potente strumento open-source incentrato sull'automazione, ideale per scansionar...

Gxss

Il progetto è ora deprecato poiché Dalfox ha un'opzione di discovery che può essere usata per identificare parametri riflessi dalfox file urls.txt --skip-xss-scanning -o reflecting.txt Gxss v4.0 Uno strumento leggero per verificare i parametri riflessi in un URL. Ispirato da kxss di @tomnomnom...

Weekly Metasploit Update: Modules for Audiobookshelf, LiteLLM, Next.js, Dalfox and more

Help shape the future of Metasploit Framework We are planning future work in relation to the evasion capabilities present in Metasploit Framework, and how they function/are presented to users. We are currently accepting responses to our feedback form, which means that you can shape the future of...

GO-2026-5649 Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` in github.com/hahwul/dalfox

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via found-action in github.com/hahwul/dalfox...

GO-2026-5257 Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option in github.com/hahwul/dalfox

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via output Option in github.com/hahwul/dalfox...

GO-2026-5070 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in github.com/hahwul/dalfox...

CVE-2026-45088

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...

CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

CVE-2026-45089

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated...

CVE-2026-45090

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes...

CVE-2026-45090

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs two sequential worker stages that both write to the same results channel. The channel is correctly closed after the first stage completes...

CVE-2026-45089

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker's request body, then propagated...

CVE-2026-45088

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...

CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

EUVD-2026-32616

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...

CVE-2026-45088 Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...