Xss Validate
xss_validateConfirm reflected XSS on a URL with dalfox. Optionally use tier B payload lists or vendor-specific WAF bypass sets to trigger payloads when standard tests fail.
Instructions
[EXPLOIT — requires human approval] Confirm reflected XSS on a URL with dalfox.
payload_list optionally names a tier B list from the vetted payload store
to hand dalfox via --custom-payload. Leave it unset first: dalfox's
built-in payloads are context-aware and prove most reflected XSS on their own.
Reach for a list when a parameter reflects but nothing fires —
xss-waf-bypass against a filtering target, xss-polyglots when the
injection context is unclear, xss-js-frameworks for a Vue/Angular front
end. Tier B is injection payloads, not discovery wordlists, and this is the
only tool that can request one.
bypass_vendor names a WAF vendor whose ordered XSS bypass set is looked
up from the knowledge base and handed to dalfox via --custom-payload the
same way a tier B list would be. The exploit chain uses it to re-test a
point whose base pass came back clean: the WAF may have eaten the textbook
payloads while the vendor-specific set gets through.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| payload_list | No | ||
| bypass_vendor | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||