[{"data":1,"prerenderedAt":648},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-automate-advanced-xss-with-xsstrike-and-dalfox":33,"post-nav-automate-advanced-xss-with-xsstrike-and-dalfox":635,"video-automate-advanced-xss-with-xsstrike-and-dalfox":630,"i-tabler:copy":646},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":620,"coverImage":624,"date":625,"description":626,"draft":14,"extension":627,"meta":628,"navigation":30,"noindex":14,"path":629,"readingTime":630,"seo":631,"slug":632,"stem":632,"updatedAt":633,"youtubeId":630,"__hash__":634},"blog\u002Fautomate-advanced-xss-with-xsstrike-and-dalfox.md","🚀 Automate Advanced XSS with XSStrike and Dalfox ⚙️",{"type":37,"value":38,"toc":614},"minimark",[39,42,50,70,79,86,112,118,124,157,163,168,229,232,235,256,259,264,294,297,305,310,358,363,367,501,506,511,528,531,536,558,561,565,584,587,601,607,610],[40,41],"post-media",{},[43,44,46],"h2",{"id":45},"introduction",[47,48,49],"strong",{},"Introduction",[51,52,53,54,63,64,69],"p",{},"In the realm of cybersecurity, mastering XSS (Cross-Site Scripting) attacks is a pivotal skill. Today, we embark on a journey to solve labs crafted by the renowned Bortis Wigger, using advanced tools to automate and elevate XSS attacks. Our arsenal includes ",[55,56,62],"a",{"href":57,"rel":58,"target":61},"https:\u002F\u002Fgithub.com\u002Fhahwul\u002Fdalfox?utm_source=amrelsagaei.com&utm_medium=referral",[59,60],"noopener","noreferrer","_blank","DalFox",", ",[55,65,68],{"href":66,"rel":67,"target":61},"https:\u002F\u002Fgithub.com\u002Fs0md3v\u002FXSStrike?utm_source=amrelsagaei.com&utm_medium=referral",[59,60],"XSStrike",", and BurpSuite, each offering unique capabilities to streamline our penetration testing prowess. Let's delve into the intricacies of these tools and unlock the secrets to efficient XSS automation.",[43,71,73],{"id":72},"dalefox",[55,74,76],{"href":66,"rel":75,"target":61},[59,60],[47,77,78],{},"DaleFox",[80,81,83],"h5",{"id":82},"installation",[47,84,85],{},"Installation",[87,88,93],"pre",{"code":89,"language":90,"meta":91,"className":92,"style":91},"go install github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[94,95,96],"code",{},[97,98,101,105,109],"span",{"class":99,"line":100},"line",1,[97,102,104],{"class":103},"swzfi","go",[97,106,108],{"class":107},"sRRDT"," install",[97,110,111],{"class":107}," github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest\n",[51,113,114,117],{},[47,115,116],{},"Goal:"," Install DaleFox to perform advanced XSS scanning and detection.",[80,119,121],{"id":120},"usage",[47,122,123],{},"Usage",[87,125,127],{"code":126,"language":90,"meta":91,"className":92,"style":91},"dalfox [mode] [target] [flags]\n",[94,128,129],{},[97,130,131,134,138,142,145,148,151,154],{"class":99,"line":100},[97,132,133],{"class":103},"dalfox",[97,135,137],{"class":136},"sG2Fq"," [mode] ",[97,139,141],{"class":140},"somML","[",[97,143,144],{"class":136},"target",[97,146,147],{"class":140},"]",[97,149,150],{"class":140}," [",[97,152,153],{"class":136},"flags",[97,155,156],{"class":140},"]\n",[80,158,160],{"id":159},"example-usage",[47,161,162],{},"Example Usage",[51,164,165],{},[47,166,167],{},"Single target mode:",[87,169,171],{"code":170,"language":90,"meta":91,"className":92,"style":91},"dalfox url http:\u002F\u002Ftestphp.vulnweb.com\u002Flistproducts.php\\?cat\\=123\\&artist\\=123\\&asdf\\=ff \\\n    -b https:\u002F\u002Fyour-callback-url\n",[94,172,173,220],{},[97,174,175,177,180,183,187,190,193,197,200,203,205,207,209,212,214,217],{"class":99,"line":100},[97,176,133],{"class":103},[97,178,179],{"class":107}," url",[97,181,182],{"class":107}," http:\u002F\u002Ftestphp.vulnweb.com\u002Flistproducts.php",[97,184,186],{"class":185},"se4ZP","\\?",[97,188,189],{"class":107},"cat",[97,191,192],{"class":185},"\\=",[97,194,196],{"class":195},"sUQhE","123",[97,198,199],{"class":185},"\\&",[97,201,202],{"class":107},"artist",[97,204,192],{"class":185},[97,206,196],{"class":195},[97,208,199],{"class":185},[97,210,211],{"class":107},"asdf",[97,213,192],{"class":185},[97,215,216],{"class":107},"ff",[97,218,219],{"class":185}," \\\n",[97,221,223,226],{"class":99,"line":222},2,[97,224,225],{"class":185},"    -b",[97,227,228],{"class":107}," https:\u002F\u002Fyour-callback-url\n",[51,230,231],{},"This command scans a single target URL for XSS vulnerabilities.",[51,233,234],{},"Multiple target mode from file:",[87,236,238],{"code":237,"language":90,"meta":91,"className":92,"style":91},"dalfox file urls_file --custom-payload .\u002Fmypayloads.txt\n",[94,239,240],{},[97,241,242,244,247,250,253],{"class":99,"line":100},[97,243,133],{"class":103},[97,245,246],{"class":107}," file",[97,248,249],{"class":107}," urls_file",[97,251,252],{"class":185}," --custom-payload",[97,254,255],{"class":107}," .\u002Fmypayloads.txt\n",[51,257,258],{},"This command scans multiple URLs from a file for XSS vulnerabilities using custom payloads.",[51,260,261],{},[47,262,263],{},"Pipeline mode:",[87,265,267],{"code":266,"language":90,"meta":91,"className":92,"style":91},"cat urls_file | dalfox pipe -H AuthToken: bbadsfkasdfadsf87\n",[94,268,269],{},[97,270,271,273,275,279,282,285,288,291],{"class":99,"line":100},[97,272,189],{"class":103},[97,274,249],{"class":107},[97,276,278],{"class":277},"sfIIG"," |",[97,280,281],{"class":103}," dalfox",[97,283,284],{"class":107}," pipe",[97,286,287],{"class":185}," -H",[97,289,290],{"class":107}," AuthToken:",[97,292,293],{"class":107}," bbadsfkasdfadsf87\n",[51,295,296],{},"This command processes URLs from a file in a pipeline, with additional headers specified.",[43,298,300],{"id":299},"xsstrike",[55,301,303],{"href":66,"rel":302,"target":61},[59,60],[47,304,68],{},[80,306,308],{"id":307},"installation-1",[47,309,85],{},[87,311,313],{"code":312,"language":90,"meta":91,"className":92,"style":91},"git clone https:\u002F\u002Fgithub.com\u002Fs0md3v\u002FXSStrike.git\ncd XSStrike\npip3 install -r requirements.txt\npython3 xsstrike.py\n",[94,314,315,326,335,349],{},[97,316,317,320,323],{"class":99,"line":100},[97,318,319],{"class":103},"git",[97,321,322],{"class":107}," clone",[97,324,325],{"class":107}," https:\u002F\u002Fgithub.com\u002Fs0md3v\u002FXSStrike.git\n",[97,327,328,332],{"class":99,"line":222},[97,329,331],{"class":330},"s6_DI","cd",[97,333,334],{"class":107}," XSStrike\n",[97,336,338,341,343,346],{"class":99,"line":337},3,[97,339,340],{"class":103},"pip3",[97,342,108],{"class":107},[97,344,345],{"class":185}," -r",[97,347,348],{"class":107}," requirements.txt\n",[97,350,352,355],{"class":99,"line":351},4,[97,353,354],{"class":103},"python3",[97,356,357],{"class":107}," xsstrike.py\n",[51,359,360,362],{},[47,361,116],{}," Set up XSS Strike to automate XSS testing and identification.",[51,364,365],{},[47,366,123],{},[87,368,370],{"code":369,"language":90,"meta":91,"className":92,"style":91},"python3 xsstrike.py [-h] [-u TARGET] [--data DATA] [-t THREADS] [--seeds SEEDS] [--json] [--path] [--fuzzer] [--update] [--timeout] [--params] [--crawl] [--blind] [--skip-dom] [--headers] [--proxy] [-d DELAY] [-e ENCODING]\n",[94,371,372],{},[97,373,374,376,379,382,384,387,389,391,394,396,398,401,403,405,408,410,412,415,417,419,422,424,426,429,431,433,436,438,440,443,445,447,450,452,454,457,459,461,464,466,468,471,473,475,478,480,482,485,487,489,492,494,496,499],{"class":99,"line":100},[97,375,354],{"class":103},[97,377,378],{"class":107}," xsstrike.py",[97,380,381],{"class":136}," [-h] ",[97,383,141],{"class":140},[97,385,386],{"class":136},"-u TARGET",[97,388,147],{"class":140},[97,390,150],{"class":140},[97,392,393],{"class":136},"--data DATA",[97,395,147],{"class":140},[97,397,150],{"class":140},[97,399,400],{"class":136},"-t THREADS",[97,402,147],{"class":140},[97,404,150],{"class":140},[97,406,407],{"class":136},"--seeds SEEDS",[97,409,147],{"class":140},[97,411,150],{"class":140},[97,413,414],{"class":136},"--json",[97,416,147],{"class":140},[97,418,150],{"class":140},[97,420,421],{"class":136},"--path",[97,423,147],{"class":140},[97,425,150],{"class":140},[97,427,428],{"class":136},"--fuzzer",[97,430,147],{"class":140},[97,432,150],{"class":140},[97,434,435],{"class":136},"--update",[97,437,147],{"class":140},[97,439,150],{"class":140},[97,441,442],{"class":136},"--timeout",[97,444,147],{"class":140},[97,446,150],{"class":140},[97,448,449],{"class":136},"--params",[97,451,147],{"class":140},[97,453,150],{"class":140},[97,455,456],{"class":136},"--crawl",[97,458,147],{"class":140},[97,460,150],{"class":140},[97,462,463],{"class":136},"--blind",[97,465,147],{"class":140},[97,467,150],{"class":140},[97,469,470],{"class":136},"--skip-dom",[97,472,147],{"class":140},[97,474,150],{"class":140},[97,476,477],{"class":136},"--headers",[97,479,147],{"class":140},[97,481,150],{"class":140},[97,483,484],{"class":136},"--proxy",[97,486,147],{"class":140},[97,488,150],{"class":140},[97,490,491],{"class":136},"-d DELAY",[97,493,147],{"class":140},[97,495,150],{"class":140},[97,497,498],{"class":136},"-e ENCODING",[97,500,156],{"class":140},[80,502,504],{"id":503},"example-usage-1",[47,505,162],{},[51,507,508],{},[47,509,510],{},"Scan a single URL:",[87,512,514],{"code":513,"language":90,"meta":91,"className":92,"style":91},"python3 xsstrike.py -u http:\u002F\u002Fexample.com\u002Fsearch.php?q=query\n",[94,515,516],{},[97,517,518,520,522,525],{"class":99,"line":100},[97,519,354],{"class":103},[97,521,378],{"class":107},[97,523,524],{"class":185}," -u",[97,526,527],{"class":107}," http:\u002F\u002Fexample.com\u002Fsearch.php?q=query\n",[51,529,530],{},"This command tests a single webpage using the GET method.",[51,532,533],{},[47,534,535],{},"Supplying POST data:",[87,537,539],{"code":538,"language":90,"meta":91,"className":92,"style":91},"python3 xsstrike.py -u http:\u002F\u002Fexample.com\u002Fsearch.php --data q=query\n",[94,540,541],{},[97,542,543,545,547,549,552,555],{"class":99,"line":100},[97,544,354],{"class":103},[97,546,378],{"class":107},[97,548,524],{"class":185},[97,550,551],{"class":107}," http:\u002F\u002Fexample.com\u002Fsearch.php",[97,553,554],{"class":185}," --data",[97,556,557],{"class":107}," q=query\n",[51,559,560],{},"This command tests a URL with specified POST data.",[80,562,564],{"id":563},"crawling","Crawling",[87,566,568],{"code":567,"language":90,"meta":91,"className":92,"style":91},"python3 xsstrike.py -u http:\u002F\u002Fexample.com\u002Fpage.php --crawl\n",[94,569,570],{},[97,571,572,574,576,578,581],{"class":99,"line":100},[97,573,354],{"class":103},[97,575,378],{"class":107},[97,577,524],{"class":185},[97,579,580],{"class":107}," http:\u002F\u002Fexample.com\u002Fpage.php",[97,582,583],{"class":185}," --crawl\n",[51,585,586],{},"This command initiates a crawling process starting from the target webpage.",[588,589,590],"ul",{},[591,592,593,596],"li",{},[47,594,595],{},"Check out:",[55,597,600],{"href":598,"rel":599,"target":61},"https:\u002F\u002Fblog.amrelsagaei.com\u002Fautomating-advanced-sql-injection-with-ghauri\u002F?utm_source=amrelsagaei.com&utm_medium=referral",[59,60],"🔥 Automating Advanced SQL Injection with Ghauri!💻🛡️",[43,602,604],{"id":603},"conclusion",[47,605,606],{},"Conclusion",[51,608,609],{},"As we wrap up our exploration into XSS automation and advanced SQL techniques, we unveil the power of DalFox, XSStrike, and BurpSuite in fortifying our security strategies. Remember, continuous learning and hands-on experience are the keys to mastering cybersecurity challenges. Stay vigilant, stay informed, and keep honing your skills to stay ahead in the ever-evolving landscape of cybersecurity.",[611,612,613],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}html pre.shiki code .somML, html code.shiki .somML{--shiki-default:#666666;--shiki-light:#999999}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html pre.shiki code .sUQhE, html code.shiki .sUQhE{--shiki-default:#4C9A91;--shiki-light:#2F798A}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}",{"title":91,"searchDepth":337,"depth":337,"links":615},[616,617,618,619],{"id":45,"depth":222,"text":49},{"id":72,"depth":222,"text":78},{"id":299,"depth":222,"text":68},{"id":603,"depth":222,"text":606},[621,622,623],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fautomate-advanced-xss-with-xsstrike-and-dalfox\u002Fautomating-xss.webp","2024-05-16","Automating XSS discovery with XSStrike and Dalfox, from install through real usage against labs, combined with Burp Suite for deeper testing.","md",{},"\u002Fautomate-advanced-xss-with-xsstrike-and-dalfox",null,{"title":35,"description":626},"automate-advanced-xss-with-xsstrike-and-dalfox","2025-02-05","dgbnEKYEKAklaFsNeiPx1qIF4Kf8wzcvomS_dRoPXoo",{"older":636,"newer":640,"total":645},{"slug":637,"title":600,"date":638,"position":639},"automating-advanced-sql-injection-with-ghauri","2024-05-09",47,{"slug":641,"title":642,"date":643,"position":644},"csrf-automate-vulnerability-testing","CSRF - Automate Vulnerability Testing 🛡️🔍","2024-05-23",45,68,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":647},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941259210]