View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0009810Kali LinuxNew Tool Requestspublic2026-08-02 13:282026-08-02 13:48
Reporterqiw.def Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0009810: [Tool Request] Dalfox - Advanced XSS Scanner and Utility
Description

Hello Kali Linux Development Team,

I would like to request the inclusion of "Dalfox" into the official Kali Linux repository. Dalfox is a highly popular, fast, and advanced open-source XSS scanner used widely by penetration testers and bug bounty hunters for automating XSS flaw detection and parameter analysis.

Below are the technical details for the tool:

  • Tool Name: Dalfox
  • Vendor/Author: HAHWUL (Chanha Lee)
  • Tool URL / Download Location: https://github.com/hahwul/dalfox
  • License: MIT License
  • Similar tools already in Kali: XSStrike, XSSer

Description:
Dalfox focuses on automation, parameter analysis, and advanced DOM/AST verification. It features reflected/stored/DOM XSS scanning, WAF fingerprinting/evasion, a built-in REST API, and Model Context Protocol (MCP) server support.

Technical Notes for Packaging:

  • The project has been fully rewritten in Rust (v3.x). The build process will require 'cargo' and 'rustc' as build-dependencies.
  • Prebuilt binaries for Linux are also provided by the author on the GitHub Releases page.
  • The project is actively maintained with frequent updates.

Thank you for considering this tool request!

Activities

qiw.def

qiw.def

2026-08-02 13:48

reporter   ~0021919

Source: dalfox
Section: utils
Priority: optional
Maintainer: Kali Developers [email protected]
Build-Depends: debhelper-compat (= 13), dh-cargo, cargo, rustc, libssl-dev, pkg-config
Standards-Version: 4.6.2
Homepage: https://github.com/hahwul/dalfox

Package: dalfox
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}
Description: Advanced XSS Scanner and Utility
Dalfox is a powerful open-source XSS scanner and utility focused
on automation, parameter analysis, and advanced DOM/AST verification.
It features reflected/stored/DOM XSS scanning, WAF evasion, and a
built-in REST API.

Issue History

Date Modified Username Field Change
2026-08-02 13:28 qiw.def New Issue
2026-08-02 13:48 qiw.def Note Added: 0021919