Skip to content

Commit 61be435

Browse files
authored
fix: small typo errors
1 parent 8eada06 commit 61be435

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<a href=""><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
1313
</p>
1414

15-
DalFox is an powerful open source XSS scanning tool and parameter analyzer and utility that fast the process of detecting and verify XSS flaws. It comes with a powerful testing engine, many niche features for the cool hacker!
15+
DalFox is a powerful open source XSS scanning tool and parameter analyzer and utility that fast the process of detecting and verify XSS flaws. It comes with a powerful testing engine, many niche features for the cool hacker!
1616

1717
I talk about naming. Dal([](https://en.wiktionary.org/wiki/달)) is the Korean pronunciation of moon, and Fox are made to mean "Finder Of XSS" or 🦊
1818

@@ -36,12 +36,12 @@ Mode: `url` `sxss` `pipe` `file` `server` `payload`
3636
| Discovery | Parameter analysis | - Find reflected param<br />- Find alive/bad special chars, event handler and attack code <br />- Identification of injection points(HTML/JS/Attribute) <br /> `inHTML-none` `inJS-none` `inJS-double` `inJS-single` `inJS-backtick` `inATTR-none` `inATTR-double` `inATTR-single` |
3737
| | Static analysis | - Check bad-header like CSP, XFO, etc.. with req/res base |
3838
| | BAV analysis | - Testing BAV(Basic Another Vulnerability) , e.g `sqli` `ssti` `open-redirects`, `crlf`, `esii` |
39-
| | Parameter Mining | - Find new param with Dictonary attack (default is [GF-Patterns](https://github.com/1ndianl33t/Gf-Patterns))<br />- Support custom dictonary file (`--mining-dict-word`)<br />- Find new param with DOM<br />- Use remote wordlist to mining (`--remote-wordlists`) |
39+
| | Parameter Mining | - Find new param with Dictionary attack (default is [GF-Patterns](https://github.com/1ndianl33t/Gf-Patterns))<br />- Support custom dictionary file (`--mining-dict-word`)<br />- Find new param with DOM<br />- Use remote wordlist to mining (`--remote-wordlists`) |
4040
| | Built-in Grepping | - It Identify the basic info leak of SSTi, Credential, SQL Error, and so on |
4141
| | WAF Detection and Evasion | - Detect to WAF(Web Application Firewall). <br />- if found waf and using special flag, evasion using slow request<br />- `--waf-evasion` |
4242
| Scanning | XSS Scanning | - Reflected XSS / Stored XSS / DOM XSS<br />- DOM base verifying<br />- Headless base verifying<br />- Blind XSS testing with param, header(`-b` , `--blind` options)<br />- Only testing selected parameters (`-p`, `--param`)<br />- Only testing parameter analysis (`--only-discovery`) |
4343
| | Friendly Pipeline | - Single url mode (`dalfox url`)<br />- From file mode (`dalfox file urls.txt`)<br />- From IO(pipeline) mode (`dalfox pipe`)<br />- From raw http request file mode (`dalfox file raw.txt --rawdata`) |
44-
| | Optimizaion query of payloads | - Check the injection point through abstraction and generated the fit payload.<br />- Eliminate unnecessary payloads based on badchar |
44+
| | Optimization query of payloads | - Check the injection point through abstraction and generated the fit payload.<br />- Eliminate unnecessary payloads based on badchar |
4545
| | Encoder | - All test payloads(build-in, your custom/blind) are tested in parallel with the encoder.<br />- To Double URL Encoder<br />- To HTML Hex Encoder |
4646
| | Sequence | - Auto-check the special page for stored xss (`--trigger`) <br />- Support (`--sequence`) options for Stored XSS , only `sxss` mode |
4747
| HTTP | HTTP Options | - Overwrite HTTP Method (`-X`, `--method`)<br />- Follow redirects (`--follow-redirects`)<br />- Add header (`-H`, `--header`)<br />- Add cookie (`-C`, `--cookie`)<br />- Add User-Agent (`--user-agent`)<br />- Set timeout (`--timeout`)<br />- Set Delay (`--delay`)<br />- Set Proxy (`--proxy`)<br />- Set ignore return codes (`--ignore-return`)<br />- Load cookie from raw request (`--cookie-from-raw`) |
@@ -58,7 +58,7 @@ Mode: `url` `sxss` `pipe` `file` `server` `payload`
5858
| | Custom Payloads | - Use custom payloads list file (`--custom-payload`) <br />- Custom alert value (`--custom-alert-value`) <br />- Custom alert type (`--custom-alert-type`)|
5959
| | Remote Payloads | - Use remote payloads from portswigger, payloadbox, etc.. (`--remote-payloads`) |
6060
| Package | Package manager | - [pkg.go.dev](https://pkg.go.dev/github.com/hahwul/dalfox/v2)<br/>- [homebrew with tap](https://github.com/hahwul/homebrew-dalfox)<br />- [snapcraft](https://snapcraft.io/dalfox) |
61-
| | Docker ENV | - [docker hub](https://hub.docker.com/repository/docker/hahwul/dalfox)<br />- [gitub package of docker](https://github.com/hahwul/dalfox/packages) |
61+
| | Docker ENV | - [docker hub](https://hub.docker.com/repository/docker/hahwul/dalfox)<br />- [github package of docker](https://github.com/hahwul/dalfox/packages) |
6262
| | Other | - [github action](https://github.com/marketplace/actions/xss-scan-with-dalfox) |
6363

6464
And the various options required for the testing :D
@@ -125,7 +125,7 @@ Format
125125
| POC | V | GET | | http://testphp.vulnweb.com/listproducts.php?artist=123&asdf=ff&cat=123%22%3E%3Csvg%2Fclass%3D%22dalfox%22onLoad%3Dalert%2845%29%3E |
126126

127127
- Type: `G`(Grep) , `R`(Reflected) , ` V`(Verify)
128-
- Informatin: Method, grepping name, etc..
128+
- Information: Method, grepping name, etc..
129129

130130
Why is there a gap?
131131
It is a method to make it easier to parse only the poc code through cut etc. For example, you can do this.

0 commit comments

Comments
 (0)