Alternatives to Dalfox
Check web applications for cross-site scripting issues. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Dalfox
Check web applications for cross-site scripting issues.
Replacements
Listings that take over the same core job as Dalfox.
XSStrike
Cross-site scripting detection suite with context analysis.
XSStrike also detects cross-site scripting, building payloads from reflection context and handling DOM-based cases, though its upstream development has been quiet.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP is a Java desktop proxy combining manual inspection with automated scanning, so it covers cross-site scripting among many other web vulnerability classes.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python web vulnerability scanner for Linux and macOS that runs a broader range of application tests beyond cross-site scripting, under GPL-2.0.
Similar software
Related functionality, not a direct replacement.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Caido
Web security testing proxy for auditing web applications.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Interactsh
Collect external callbacks during authorized security tests.
