Find XSS the easy way! Dalfox - Hacker Tools

[@黑客-c6c]

This is the best xs software i have ever seen I really feel great!

[@intigriti]

Great! Any cool finds with it yet?

[@Rogerson112]

Hello. Is this true that all automatic tools only find easy vulnerability? What about XSS that to achieve it we need to bypass CSP, WAF etc. If exist can you recommend some advanced scanners for example xss, sqli ?

[@intigriti]

The general rule is; if it can be found with an automated scanner, then it would of already been found by one of the however many thousand people who ran that scan before you 😉

[@william_ade]

Thanks really appreciated!

[@intigriti]

Glad it helped!

[@tomjohnes5030]

This is definitely fire. But how to we hide its signature ? I see Dalfox populated on my testing machine logs. Not stealthy

[@intigriti]

It is most likely the user-agent that your seeing. Check the Dalfox help page to look up how to change it!

[@Dhruv-te6dy]

in video you say file containing all your endpoints means all URLs with parameters am i right? (time stamp 04:50)

[@intigriti]

Hmmm I didn't make this video so not 100% but generally when we say endpoint it's like "login endpoint = /login", "register endpoint = /register", "api endpoint = /api" etc

[@Dhruv-te6dy]

@@intigriti ok got it thanks

[@malikimranawan3762]

Can it work in finding real bug ? Bcz finding Bugs manually is much difficult ...

[@intigriti]

It can definitely help you!

[@jimgrayson4828]

Think locally bro not just wan think Lan

[@tbjehad106]

why i didn't get the ditails over view step by step after scan. it just says issue 6 thats it .but didn't said me the vulnerability, the step and payload the tool user for to find this . but in this video you shows us its tell all the step

[@william_ade]

What bistro of Linux are u using (love it) ?

[@intigriti]

I'm using Kali Linux!

[@itsm3dud39]

can you suggest some other tools like this?

[@intigriti]

We'll cover some more in the future!

[@itsm3dud39]

@@intigriti ok

[@CameronNoakes]

I can't run the tool how do you run it I get dalfox not a command

[@intigriti]

You first need to install dalfox. Look at the blog post in the description to find out how!

[@youngheej8432]

So cool hahwul!!!!!!!!!

[@intigriti]

We also like him 😇

[@Life-M77]

Super sir

[@intigriti]

🙏

[@rookie1913]

Great~

[@intigriti]

Thanks!

[@hahwul]

😍😎

[@intigriti]

Thanks for the amazing tool!

[@gurvirsingh4190]

Great 🔥

[@intigriti]

Thanks!! 🔥

[@jishan3201]

@Gurvir singh Bhai har jagah yahi comment karte ho kya.. 😀😀😀 .

[@ratmoneyg]

Does this still work?

[@intigriti]

The repo is still active, so if it's not working you can always raise an issue: github.com/hahwul/dalfox/issues

[@ratmoneyg]

@@intigriti yeah I just can’t figure out how to install it. I tried for a while yesterday but gave up lol

[@lethalleet]

First comment again 🔥

[@intigriti]

Legend!

[@lethalleet]

I need virtual tour of Intigriti office 🌞

[@mukto2004]

Does it also work with xss in input forms? Like comment

[@intigriti]

As far as I'm aware, it does!

[@Dhruv-te6dy]

@@intigriti but how can you give some example for it ?

[@intigriti]

check this example: media.geeksforgeeks.org/wp-content/uploads/20210723203017/Example1minmin.jpg which came from www.geeksforgeeks.org/dalfox-parameter-analysis-and-xss-scanning-tool

[@meljithpereira5532]

Y you dalfox is so fast ..??

[@intigriti]

Hi, for more information on the internals of the tool, feel free to check out the GitHub page and ask there!

[@techfunky9583]

Bruh how to run the assetfinder command

[@intigriti]

What timestamp are you referring to?

[@learnfirst-1]

it dosen't found xss hard challanges ...🤣🤣 specially html encoding or other escape function

[@intigriti]

Yes, true. That's normal, no tool would be able to solve those!

[@som3one0]

it is not accurate

[@intigriti]

I'm sorry! What's not accurate?

[@som3one0]

@@intigriti result

[@AkashPatel-zd4wf]

one of the worst tool i ever encounter in bug bounty

[@intigriti]

😆

[@jishan3201]

I scan testvul.php site with gau which gave me 2800 urls then scan all those with kxss which gave me 19 vulnerable urls which I gave them to dalfox but it did not find anything. I checked manualy and they were all vunerable. Why this happend. Is this tool realy helpfull.?

[@intigriti]

Be sure to submit this to the tool's GitHub page, so the creator can use it to improve the tool!

[@Free.Education786]

What to do after getting alert(XSS); pop-up because pop-up with cookies 🍪 or document.domain(); pop-up is not suitable to receive bug bounty rewards. Please guide how to escalate reflected XSS to higher levels to earn bounties on hackerOne BugCrowd intigrity etc. Thanks 😊 🤝❤️💫💐😘🥰🌺💥💯👍

[@intigriti]

Unless on a sandbox domain or static page, an XSS should allow you to get a bounty on Intigriti.

[@writecode9932]

Nice one... Thanks for sharing (rahulsl)

[@intigriti]

Glad you liked it! 😇