DALFOX Files

3.2.1

A false-positive / recall fix on framework error pages, stability hardening, and dalfox payload improvements.

• Fan-out cost cuts no longer delete the finding they bound: mining collapse folds away only what it mined itself — a page echoing its whole query string used to report a POC against a synthetic any parameter while missing the real one — and a 5xx that reflects the payload no longer ends the DOM phase (#1362).
• Hardened against crashes, hangs, and scans that reported clean without scanning: a panic on non-ASCII Trusted Types callbacks was swallowed into 0 XSS / exit 0, quadratic HTML-nesting parses, unbounded memory in JS-breakout payloads and retained bodies, --only-custom-payload with no file, --skip-xss-scanning still firing blind payloads, --cookies folding into one cookie, and unvalidated --sxss-* (#1361).
• dalfox server refuses browser-driven cross-site and DNS-rebound requests via an Origin / Sec-Fetch-Site / Host gate (#1356).
• Cookie parameters are injected as cookies rather than same-named headers and survive the special-character probe (cookie recall 80.0% → 87.5%); no more [V] for text/plain + nosniff; -f plain -o no longer writes ANSI; -f markdown no longer prints the banner (#1315).
• Light-verify sends a Content-Type with urlencoded bodies, --limit aborts workers instead of detaching them, and REST / MCP rate_limit now covers discovery and mining (#1360).
• dalfox payload: JSON output, an all selector, per-selector counts, closest-selector suggestions, and wider uri-scheme / special-character lists (#1358, #1346, #1348, #1349, #1350).
• Modern JavaScript framework detection (#1352).

New Contributors

• @aetherloop made their first contribution in https://github.com/hahwul/dalfox/pull/1308
• @MannXo made their first contribution in https://github.com/hahwul/dalfox/pull/1310
• @ZhangStudyLife made their first contribution in https://github.com/hahwul/dalfox/pull/1318
• @Vermitrude made their first contribution in https://github.com/hahwul/dalfox/pull/1324
• @floze-the-genius made their first contribution in https://github.com/hahwul/dalfox/pull/1340
• @shixi-li made their first contribution in https://github.com/hahwul/dalfox/pull/1349
• @nightcityblade made their first contribution in https://github.com/hahwul/dalfox/pull/1352

Full Changelog: https://github.com/hahwul/dalfox/compare/v3.2.0...v3.2.1