Find XSS the easy way! Dalfox - Hacker Tools

[@黑客-c6c]

This is the best xs software i have ever seen I really feel great!

[@intigriti]

Great! Any cool finds with it yet?

[@tbjehad106]

why i didn't get the ditails over view step by step after scan. it just says issue 6 thats it .but didn't said me the vulnerability, the step and payload the tool user for to find this . but in this video you shows us its tell all the step

[@Rogerson112]

Hello. Is this true that all automatic tools only find easy vulnerability? What about XSS that to achieve it we need to bypass CSP, WAF etc. If exist can you recommend some advanced scanners for example xss, sqli ?

[@intigriti]

The general rule is; if it can be found with an automated scanner, then it would of already been found by one of the however many thousand people who ran that scan before you 😉

[@Dhruv-te6dy]

in video you say file containing all your endpoints means all URLs with parameters am i right? (time stamp 04:50)

[@intigriti]

Hmmm I didn't make this video so not 100% but generally when we say endpoint it's like "login endpoint = /login", "register endpoint = /register", "api endpoint = /api" etc

[@Dhruv-te6dy]

@@intigriti ok got it thanks

[@william_ade]

Thanks really appreciated!

[@intigriti]

Glad it helped!

[@tomjohnes5030]

This is definitely fire. But how to we hide its signature ? I see Dalfox populated on my testing machine logs. Not stealthy

[@intigriti]

It is most likely the user-agent that your seeing. Check the Dalfox help page to look up how to change it!

[@CameronNoakes]

I can't run the tool how do you run it I get dalfox not a command

[@intigriti]

You first need to install dalfox. Look at the blog post in the description to find out how!

[@malikimranawan3762]

Can it work in finding real bug ? Bcz finding Bugs manually is much difficult ...

[@intigriti]

It can definitely help you!

[@jimgrayson4828]

Think locally bro not just wan think Lan

[@itsm3dud39]

can you suggest some other tools like this?

[@intigriti]

We'll cover some more in the future!

[@itsm3dud39]

@@intigriti ok

[@william_ade]

What bistro of Linux are u using (love it) ?

[@intigriti]

I'm using Kali Linux!

[@gurvirsingh4190]

Great 🔥

[@intigriti]

Thanks!! 🔥

[@jishan3201]

@Gurvir singh Bhai har jagah yahi comment karte ho kya.. 😀😀😀 .

[@youngheej8432]

So cool hahwul!!!!!!!!!

[@intigriti]

We also like him 😇

[@Life-M77]

Super sir

[@intigriti]

🙏

[@rookie1913]

Great~

[@intigriti]

Thanks!

[@ratmoneyg]

Does this still work?

[@intigriti]

The repo is still active, so if it's not working you can always raise an issue: github.com/hahwul/dalfox/issues

[@ratmoneyg]

@@intigriti yeah I just can’t figure out how to install it. I tried for a while yesterday but gave up lol

[@hahwul]

😍😎

[@intigriti]

Thanks for the amazing tool!

[@techfunky9583]

Bruh how to run the assetfinder command

[@intigriti]

What timestamp are you referring to?

[@lethalleet]

First comment again 🔥

[@intigriti]

Legend!

[@lethalleet]

I need virtual tour of Intigriti office 🌞

[@mukto2004]

Does it also work with xss in input forms? Like comment

[@intigriti]

As far as I'm aware, it does!

[@Dhruv-te6dy]

@@intigriti but how can you give some example for it ?

[@intigriti]

check this example: media.geeksforgeeks.org/wp-content/uploads/20210723203017/Example1minmin.jpg which came from www.geeksforgeeks.org/dalfox-parameter-analysis-and-xss-scanning-tool

[@meljithpereira5532]

Y you dalfox is so fast ..??

[@intigriti]

Hi, for more information on the internals of the tool, feel free to check out the GitHub page and ask there!

[@learnfirst-1]

it dosen't found xss hard challanges ...🤣🤣 specially html encoding or other escape function

[@intigriti]

Yes, true. That's normal, no tool would be able to solve those!

[@AkashPatel-zd4wf]

one of the worst tool i ever encounter in bug bounty

[@intigriti]

😆

[@som3one0]

it is not accurate

[@intigriti]

I'm sorry! What's not accurate?

[@som3one0]

@@intigriti result

[@jishan3201]

I scan testvul.php site with gau which gave me 2800 urls then scan all those with kxss which gave me 19 vulnerable urls which I gave them to dalfox but it did not find anything. I checked manualy and they were all vunerable. Why this happend. Is this tool realy helpfull.?

[@intigriti]

Be sure to submit this to the tool's GitHub page, so the creator can use it to improve the tool!

[@Free.Education786]

What to do after getting alert(XSS); pop-up because pop-up with cookies 🍪 or document.domain(); pop-up is not suitable to receive bug bounty rewards. Please guide how to escalate reflected XSS to higher levels to earn bounties on hackerOne BugCrowd intigrity etc. Thanks 😊 🤝❤️💫💐😘🥰🌺💥💯👍

[@intigriti]

Unless on a sandbox domain or static page, an XSS should allow you to get a bounty on Intigriti.

[@writecode9932]

Nice one... Thanks for sharing (rahulsl)

[@intigriti]

Glad you liked it! 😇