Skip to content

Commit 7d91b63

Browse files
hahwulhahwul
committed
Update docs
1 parent 6c24c65 commit 7d91b63

File tree

3 files changed

+111
-100
lines changed

3 files changed

+111
-100
lines changed

‎docs/_docs/json.md‎

Lines changed: 34 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -8,29 +8,20 @@ permalink: /docs/json/
88
{
99
"logs": null,
1010
"pocs": [
11-
{
12-
"type": "R",
13-
"inject_type": "inHTML-none(1)-URL",
14-
"poc_type": "plain",
15-
"method": "GET",
16-
"data": "https://xss-game.appspot.com/level1/frame?query=%3Cxmp%3E%3Cp+title%3D%22%3C%2Fxmp%3E%3Csvg%2Fonload%3Dprint%281%29%3E",
17-
"param": "query",
18-
"payload": "\u003cxmp\u003e\u003cp title=\"\u003c/xmp\u003e\u003csvg/onload=print(1)\u003e",
19-
"evidence": "13 line: s were found for \u003cb\u003e\u003cxmp\u003e\u003cp title=\"\u003c/xmp\u003e\u003csvg/onload=print(1)\u003e\u003c/b\u003e. \u003ca href='?'\u003e",
20-
"cwe": "CWE-79",
21-
"severity": "Medium"
22-
},
2311
{
2412
"type": "V",
2513
"inject_type": "inHTML-none(1)-URL",
2614
"poc_type": "plain",
2715
"method": "GET",
28-
"data": "https://xss-game.appspot.com/level1/frame?query=%3CdETAILS%250aopen%250aonToGgle%250a%3D%250aa%3Dprompt%2Ca%28%29+class%3Ddalfox%3E",
16+
"data": "https://xss-game.appspot.com/level1/frame?query=%3Caudio+controls+ondurationchange%3Dalert%281%29+id%3Ddalfox%3E%3Csource+src%3D1.mp3+type%3Daudio%2Fmpeg%3E%3C%2Faudio%3E",
2917
"param": "query",
30-
"payload": "\u003cdETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() class=dalfox\u003e",
31-
"evidence": "13 line: s were found for \u003cb\u003e\u003cdETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() class=dalfox\u003e\u003c",
18+
"payload": "\u003caudio controls ondurationchange=alert(1) id=dalfox\u003e\u003csource src=1.mp3 type=audio/mpeg\u003e\u003c/audio\u003e",
19+
"evidence": "13 line: s were found for \u003cb\u003e\u003caudio controls ondurationchange=alert(1) id=dalfox\u003e\u003csource ",
3220
"cwe": "CWE-79",
33-
"severity": "High"
21+
"severity": "High",
22+
"message_id": 223,
23+
"message_str": "Triggered XSS Payload (found DOM Object): query=\u003caudio controls ondurationchange=alert(1) id=dalfox\u003e\u003csource src=1.mp3 type=audio/mpeg\u003e\u003c/audio\u003e",
24+
"raw_request": "GET /level1/frame?query=%3Caudio+controls+ondurationchange%3Dalert%281%29+id%3Ddalfox%3E%3Csource+src%3D1.mp3+type%3Daudio%2Fmpeg%3E%3C%2Faudio%3E HTTP/1.1\r\nHost: xss-game.appspot.com\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\r\nAccept-Encoding: gzip\r\n\r\n"
3425
}
3526
],
3627
"params": [
@@ -41,33 +32,33 @@ permalink: /docs/json/
4132
"ReflectedPoint": "/inHTML-none(1)",
4233
"ReflectedCode": "13 line: Sorry, no results were found for \u003cb\u003eDalFox\u003c/b\u003e. \u003ca href='?'\u003eTry again",
4334
"Chars": [
44-
"\u003e",
45-
"-",
46-
"\u003c",
47-
"\"",
48-
"[",
49-
",",
5035
"\\",
51-
"]",
52-
"(",
53-
"$",
54-
":",
55-
";",
56-
"{",
57-
"`",
58-
"'",
59-
"}",
6036
")",
37+
"|",
38+
"\"",
39+
"'",
40+
"-",
41+
"`",
42+
"\u003e",
43+
"$",
6144
"+",
45+
"]",
6246
"=",
63-
"|",
64-
"."
47+
";",
48+
":",
49+
"[",
50+
"}",
51+
"{",
52+
",",
53+
"(",
54+
".",
55+
"\u003c"
6556
]
6657
}
6758
],
68-
"duration": 6254560167,
69-
"start_time": "2022-09-16T13:24:02.693407+09:00",
70-
"end_time": "2022-09-16T13:24:08.947901+09:00"
59+
"duration": 4841809667,
60+
"start_time": "2023-03-28T11:07:15.574531+09:00",
61+
"end_time": "2023-03-28T11:07:20.416285+09:00"
7162
}
7263
```
7364

@@ -83,7 +74,11 @@ permalink: /docs/json/
8374
"payload":"Attack Value",
8475
"evidence":"Evidence with response body",
8576
"cwe":"CWE ID",
86-
"severity": "Severity (Low/Medium/High)"
77+
"severity": "Severity (Low/Medium/High)",
78+
"message_id": "Message ID",
79+
"message_str": "Message String (POC)",
80+
"raw_request": "Raw HTTP Request (require --output-request flag)",
81+
"raw_response": "Raw HTTP Response (require --output-response flag)"
8782
}
8883
```
8984

@@ -99,6 +94,8 @@ permalink: /docs/json/
9994
| evidence | Evidence with response body | - Simple codeview of where it's injected in response body. |
10095
| cwe | CWE ID | - Mapping CWE ID |
10196
| severity | Severity | - Severity (Low/Medium/High) |
97+
| raw_request | Raw HTTP Request | - Raw HTTP Request |
98+
| raw_response| Raw HTTP Response | - Raw HTTP Response |
10299

103100
```json
104101
{

‎docs/_docs/output-handling.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,8 @@ Command (only grep and verified poc)
7777
```
7878
▶ dalfox url http://testphp.vulnweb.com/listproducts.php --only-poc=g,v
7979
```
80+
81+
## Save Traffic in HAR File
82+
```
83+
▶ dalfox url http://testphp.vulnweb.com/listproducts.php --har-file-path=log.har
84+
```

‎docs/_docs/usage.md‎

Lines changed: 72 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -19,69 +19,78 @@ Modes:
1919
version Show version
2020
2121
Global Flags:
22-
-b, --blind string Add your blind xss
23-
* Example: -b your-callback-url
24-
--config string Using config from file
25-
-C, --cookie string Add custom cookie
26-
--cookie-from-raw string Load cookie from burp raw http request
27-
* Example: --cookie-from-raw request.txt
28-
--custom-alert-type string Change alert value type
29-
* Example: --custom-alert-type=none / --custom-alert-type=str,none (default "none")
30-
--custom-alert-value string Change alert value
31-
* Example: --custom-alert-value=document.cookie (default "1")
32-
--custom-payload string Add custom payloads from file
33-
-d, --data string Using POST Method and add Body data
34-
--debug debug mode, save all log using -o option
35-
--deep-domxss DOM XSS Testing with more payloads on headless [so slow]
36-
--delay int Milliseconds between send to same host (1000==1s)
37-
-F, --follow-redirects Following redirection
38-
--format string Stdout output format
39-
* Supported: plain / json (default "plain")
40-
--found-action string If found weak/vuln, action(cmd) to next
41-
* Example: --found-action='./notify.sh'
42-
--found-action-shell string Select shell application for --found-action (default "bash")
43-
--grep string Using custom grepping file
44-
* Example: --grep ./samples/sample_grep.json
45-
-H, --header string Add custom headers
46-
-h, --help help for dalfox
47-
--ignore-return string Ignore scanning from return code
48-
* Example: --ignore-return 302,403,404
49-
-X, --method string Force overriding HTTP Method
50-
* Example: -X PUT (default "GET")
51-
--request-method Use custom method for --trigger url ( default "GET" )
52-
--mining-dict Find new parameter with dictionary attack, default is Gf-Patterns=>XSS (default true)
53-
-W, --mining-dict-word string Custom wordlist file for param mining
54-
* Example: --mining-dict-word word.txt
55-
--mining-dom Find new parameter in DOM (attribute/js value) (default true)
56-
--no-color Not use colorize
57-
--no-spinner Not use spinner
58-
--only-custom-payload Only testing custom payload (required --custom-payload)
59-
--only-discovery Only testing parameter analysis (same '--skip-xss-scanning' option)
60-
--only-poc string Shows only the PoC code for the specified pattern (g: grep / r: reflected / v: verified)
61-
-o, --output string Write to output file (By default, only the PoC code is saved)
62-
--output-all All log write mode (-o or stdout)
63-
-p, --param string Only testing selected parameters
64-
--proxy string Send all request to proxy server
65-
* Example: --proxy http://127.0.0.1:8080
66-
--remote-payloads string Using remote payload for XSS testing
67-
* Supported: portswigger/payloadbox
68-
* Example: --remote-payloads=portswigger,payloadbox
69-
--remote-wordlists string Using remote wordlists for param mining
70-
* Supported: burp/assetnote
71-
* Example: --remote-wordlists=burp
72-
--report Show detail report
73-
--report-format string Format of --report flag [plain/json] (default "plain")
74-
-S, --silence Not printing all logs
75-
--skip-bav Skipping BAV(Basic Another Vulnerability) analysis
76-
--skip-grepping Skipping built-in grepping
77-
--skip-headless Skipping headless browser base scanning[DOM XSS and inJS verify]
78-
--skip-mining-all Skipping ALL parameter mining
79-
--skip-mining-dict Skipping Dict base parameter mining
80-
--skip-mining-dom Skipping DOM base parameter mining
81-
--skip-xss-scanning Skipping XSS Scanning (same '--only-discovery' option)
82-
--timeout int Second of timeout (default 10)
83-
--user-agent string Add custom UserAgent
84-
-w, --worker int Number of worker (default 100)
22+
-b, --blind string Add your blind xss
23+
* Example: -b your-callback-url
24+
--config string Using config from file
25+
-C, --cookie string Add custom cookie
26+
--cookie-from-raw string Load cookie from burp raw http request
27+
* Example: --cookie-from-raw request.txt
28+
--custom-alert-type string Change alert value type
29+
* Example: --custom-alert-type=none / --custom-alert-type=str,none (default "none")
30+
--custom-alert-value string Change alert value
31+
* Example: --custom-alert-value=document.cookie (default "1")
32+
--custom-payload string Add custom payloads from file
33+
-d, --data string Using POST Method and add Body data
34+
--debug debug mode, save all log using -o option
35+
--deep-domxss DOM XSS Testing with more payloads on headless [so slow]
36+
--delay int Milliseconds between send to same host (1000==1s)
37+
-F, --follow-redirects Following redirection
38+
--format string Stdout output format
39+
* Supported: plain / json (default "plain")
40+
--found-action string If found weak/vuln, action(cmd) to next
41+
* Example: --found-action='./notify.sh'
42+
--found-action-shell string Select shell application for --found-action (default "bash")
43+
--grep string Using custom grepping file
44+
* Example: --grep ./samples/sample_grep.json
45+
--har-file-path string Path to save HAR of scan requests to
46+
-H, --header strings Add custom headers
47+
-h, --help help for dalfox
48+
--ignore-param strings Ignores this parameter when scanning.
49+
* Example: --ignore-param api_token --ignore-param csrf_token
50+
--ignore-return string Ignores scanning from return code
51+
* Example: --ignore-return 302,403,404
52+
-X, --method string Force overriding HTTP Method
53+
* Example: -X PUT (default "GET")
54+
--mining-dict Find new parameter with dictionary attack, default is Gf-Patterns=>XSS (default true)
55+
-W, --mining-dict-word string Custom wordlist file for param mining
56+
* Example: --mining-dict-word word.txt
57+
--mining-dom Find new parameter in DOM (attribute/js value) (default true)
58+
--no-color Not use colorize
59+
--no-spinner Not use spinner
60+
--only-custom-payload Only testing custom payload (required --custom-payload)
61+
--only-discovery Only testing parameter analysis (same '--skip-xss-scanning' option)
62+
--only-poc string Shows only the PoC code for the specified pattern (g: grep / r: reflected / v: verified)
63+
* Example: --only-poc='g,v'
64+
-o, --output string Write to output file (By default, only the PoC code is saved)
65+
--output-all All log write mode (-o or stdout)
66+
--output-request Include raw HTTP requests in the results.
67+
--output-response Include raw HTTP response in the results.
68+
-p, --param strings Only testing selected parameters
69+
--poc-type string Select PoC type
70+
* Supported: plain/curl/httpie/http-request
71+
* Example: --poc-type='curl' (default "plain")
72+
--proxy string Send all request to proxy server
73+
* Example: --proxy http://127.0.0.1:8080
74+
--remote-payloads string Using remote payload for XSS testing
75+
* Supported: portswigger/payloadbox
76+
* Example: --remote-payloads=portswigger,payloadbox
77+
--remote-wordlists string Using remote wordlists for param mining
78+
* Supported: burp/assetnote
79+
* Example: --remote-wordlists=burp
80+
--report Show detail report
81+
--report-format string Format of --report flag [plain/json] (default "plain")
82+
-S, --silence Only print PoC Code and Progress(for pipe/file mode)
83+
--skip-bav Skipping BAV(Basic Another Vulnerability) analysis
84+
--skip-grepping Skipping built-in grepping
85+
--skip-headless Skipping headless browser base scanning[DOM XSS and inJS verify]
86+
--skip-mining-all Skipping ALL parameter mining
87+
--skip-mining-dict Skipping Dict base parameter mining
88+
--skip-mining-dom Skipping DOM base parameter mining
89+
--skip-xss-scanning Skipping XSS Scanning (same '--only-discovery' option)
90+
--timeout int Second of timeout (default 10)
91+
--user-agent string Add custom UserAgent
92+
--waf-evasion Avoid blocking by adjusting the speed when detecting WAF (worker=1 delay=3s)
93+
-w, --worker int Number of worker (default 100)
8594
8695
Server Flags:
8796
-h, --help help for server

0 commit comments

Comments
 (0)