github.com / hahwul

hahwul/dalfox

Rust·538 files·commit 1e609fe·scanned 4m ago·cached ✓

25/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 5,302 stars — findings likely legitimate code patterns

verdict accurate?

47% file coverage

threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.src/cmd/payload.rs

        "[].constructor.constructor('alert(1)')()",
        "eval('alert(1)')",
        // Reconstruct the keyword from fragments
        "window['al'+'ert'](1)",

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/cmd/scan/poc/tests.rs

fn shell_argv(command: &str) -> Vec<String> {
    let out = std::process::Command::new("/bin/sh")
        .arg("-c")
        // NUL-separated: a parameter name containing a newline is still one

criticalRust process Command usagestd::process::Command can execute arbitrary shell commands. Malware uses it to drop payloads, exfiltrate data, or establish persistence.src/main.rs

    let full = Cli::command();
    let mut cmd = clap::Command::new(BIN_NAME)
        .version(env!("CARGO_PKG_VERSION"))
        .args(full.get_arguments().cloned())

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.src/payload/synthesis/tests.rs

    let js_call = [
        "alert(", "confirm(", "prompt(", "alert`", "confirm`", "prompt`", "eval(",
    ]
    .iter()

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.src/payload/xss_csp_bypass.rs

//! - `unsafe-inline`: Direct inline script execution
//! - `unsafe-eval`: eval()-based execution
//! - Missing `base-uri`: `<base>` tag injection to redirect relative URLs
//! - Missing `object-src`:...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.src/payload/xss_javascript.rs

    // Like `>`, whitespace ends an *unquoted* attribute value, so no SMALL
    // primitive may contain a space: `onerror=new Function(…)` parses as
    // `onerror="new"` (a SyntaxError) plus a junk...

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.src/scanning/ast_dom_analysis/tests.rs

        let code = location.hash;
        let fn = new Function(code);
"#;
    let analyzer = AstDomAnalyzer::new();

criticalFunction() constructor detectednew Function() is equivalent to eval() and can execute arbitrary code strings.src/scanning/js_context_verify/tests.rs


    let payload_new = "new Function('alert(1)')()";
    let html_new = format!("<script>{}</script>", payload_new);
    assert!(has_js_context_evidence(payload_new, &html_new));

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningRust wallet/crypto code with network activityCode handling private keys or signing and also making network requests may be exfiltrating secrets or sending funds to an attacker.src/cmd/scan/args.rs

pub const DEFAULT_WAF_BYPASS: &str = "auto";
pub const DEDUP_URLS_VALUES: &[&str] = &["exact", "signature", "off"];
/// Default for `--dedup-urls`: collapse only byte-identical `url|method`
/// pairs,...

    // Default 0.0 keeps every match; users tighten this to suppress
    // weak signals (0.3 "Request blocked", 0.5 "Server: Google
    // Frontend", etc.) that often false-positive on benign origins...

    /// Did the authenticated page *already* show a login form? Some apps render
    /// one in a header/modal even when signed in, so "a password field appeared"
    /// is only a loss signal if the ...

infoBase64 encoding usedatob() or Buffer.from with base64. Common in legitimate code but also used to hide malicious URLs.src/payload/xss_javascript.rs

    "setTimeout('ale'+'rt(1)')", // setTimeout with string concat
    "window[atob('YWxlcnQ=')](1)", // atob-based keyword reconstruction
    "location='javas'+'cript:ale'+'rt(1)'", // location assign...

warningClipboard read accessnavigator.clipboard.readText() reads the user's clipboard. In a wallet/crypto context this is often used to steal copied seed phrases or private keys.src/scanning/ast_dom_analysis/async_flow.rs

        const ASYNC_TAINTED_SOURCE_CALLS: &[&str] = &[
            // `navigator.clipboard.readText()` resolves to the clipboard text —
            // the async counterpart of the `event.clipboardData...

        // fetch().then(...) response-source chains (issue #1024) and async
        // source chains such as `navigator.clipboard.readText().then(...)`.
        // Drive the whole chain here so each c...

fn clipboard_read_text_promise_chain_to_innerhtml() {
    // `navigator.clipboard.readText()` resolves directly to the untrusted
    // string, so the `.then` parameter is tainted at the chain root — ...

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.src/cmd/payload.rs+4

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

255 files scanned @ 1e609fe | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration25

file system access12

obfuscation4

supply chain0

owasp / injection0

telemetry

files 255/538rules hit 17engine v6commit 1e609fe

github

hahwul/dalfox

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Rust

5302

569

2357d

538 files

255 scanned(47%)

1e609fe

architecture░▒▓

entry (2) flagged (39) pkg (95)

344 nodes · 287 edgesscroll to zoom · click node to jump to finding