dalfox/Cargo.toml at main · hahwul/dalfox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
[package]
name = "dalfox"
version = "3.1.2"
edition = "2024"
rust-version = "1.93"
authors = ["hahwul"]
description = "Dalfox is a powerful open-source XSS scanner and utility focused on automation"
license = "MIT"
homepage = "https://github.com/hahwul/dalfox"
repository = "https://github.com/hahwul/dalfox"

[dependencies]
clap = { version = "4.0", features = ["derive", "env"] }
url = "2.0"
reqwest = { version = "0.13", default-features = false, features = [
    "rustls-no-provider",
    "socks", "multipart", "json", "form", "gzip", "deflate", "brotli"
] }
# Pin rustls to the `ring` crypto backend instead of the default `aws-lc-rs`.
# aws-lc-sys ships C/asm that fails to link on several distros (AUR, musl,
# etc. — see #1061), whereas ring's prebuilt assembly is portable. reqwest's
# `rustls-no-provider` feature leaves the crypto provider unset, so we install
# ring's as the process default (see `dalfox::ensure_crypto_provider`).
rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
scraper = "0.27"
tokio = { version = "1", features = ["full"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
indicatif = "0.18"
console = "0.16"
urlencoding = "2.1"
base64 = "0.22"
chrono = "0.4"
toml = "1"
axum = "0.8"
sha2 = "0.11"
hex = "0.4"
regex = "1"
rmcp = { version = "2.1.0", features = ["server", "macros"] }
schemars = { version = "1", features = ["derive"] }
oxc_parser = "0.133.0"
oxc_ast = "0.133.0"
oxc_allocator = "0.133.0"
oxc_span = "0.133.0"

# OOB / OAST (interactsh) blind-XSS support. interactsh needs RSA-OAEP(SHA-256)
# to unwrap the per-poll AES key and AES-256-CTR to decrypt each interaction.
# `rsa` 0.9 is built against the digest/sha2 0.10 line, so the OAEP digest comes
# from an aliased `sha2 0.10` (`sha2_oaep`) — the existing `sha2 0.11` above is
# left untouched for response fingerprinting.
# `rand` is kept at 0.8 (rsa 0.9 binds rand_core 0.6); aes/ctr can be newer
# (we use the modern cipher 0.5+ KeyIvInit API for AES-256-CTR).
rsa = { version = "0.9", features = ["pem"] }
aes = "0.9"
ctr = "0.10"
rand = "0.8"
uuid = { version = "1", features = ["v4"] }
sha2_oaep = { package = "sha2", version = "0.10" }

[profile.release]
lto = true
codegen-units = 1
strip = "symbols"

[package.metadata.deb]
maintainer = "hahwul <hahwul@gmail.com>"
copyright = "2024, hahwul"
license-file = "LICENSE.txt"
extended-description = """Dalfox is a powerful open-source XSS scanner and automation utility.
It supports reflected, stored, and DOM-based XSS discovery with AST-backed verification."""
depends = ["ca-certificates"]
section = "utils"
priority = "optional"
assets = [
    { source = "target/release/dalfox", dest = "/usr/bin/dalfox", mode = "755" },
]

[package.metadata.generate-rpm]
license = "MIT"
summary = "Powerful open-source XSS scanner"
group = "Applications/System"
homepage = "https://github.com/hahwul/dalfox"
description = """Dalfox is a powerful open-source XSS scanner and automation utility.
It supports reflected, stored, and DOM-based XSS discovery with AST-backed verification."""
assets = [
    { source = "target/release/dalfox", dest = "/usr/bin/dalfox", mode = "755" },
]