+++
title = "XSSMaze Score"
description = "How much of the XSSMaze lab Dalfox detects, measured against the main branch."
weight = 4
toc = true
+++

[XSSMaze](https://github.com/hahwul/xssmaze) is an intentionally vulnerable lab for measuring XSS-detection tooling. This page tracks how much of the **`main`** image (`ghcr.io/hahwul/xssmaze:main`) Dalfox detects. The numbers below are auto-generated by `just xssmaze-score`, never hand-written.

## Latest score

<!-- XSSMAZE:BEGIN — generated by `just xssmaze-score`; do not edit by hand -->

<div style="margin:1.5rem 0;padding:1.6rem 1.75rem;background:radial-gradient(120% 140% at 100% 0%,rgba(139,148,232,0.10),transparent 55%),linear-gradient(135deg,var(--bg-surface,#11141f),var(--bg-sidebar,#0b0d18));border:1px solid var(--border-light,#222741);border-radius:14px"><div style="font-size:.72rem;font-weight:600;text-transform:uppercase;letter-spacing:.12em;color:var(--text-muted,#636980)">Detection score</div><div style="display:flex;align-items:baseline;margin-top:.4rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums"><span style="font-size:clamp(2.6rem,9vw,3.6rem);font-weight:700;line-height:1;letter-spacing:-.02em">97.9</span><span style="font-size:1.6rem;font-weight:600;color:var(--text-secondary,#9aa0bb)">%</span></div><div style="margin-top:.55rem;font-size:.95rem;color:var(--text-secondary,#9aa0bb)"><strong style="color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">1014</strong> / 1036 endpoints detected across 171 categories</div><div style="margin-top:1.4rem;height:.6rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><div style="height:100%;width:97.9%;background:#34d399;box-shadow:0 0 16px rgba(52,211,153,0.45);border-radius:999px"></div></div><div style="margin-top:1.3rem;padding-top:1rem;border-top:1px solid var(--border,#161a28);display:flex;flex-wrap:wrap;gap:.4rem 1.25rem;font-size:.8rem;color:var(--text-muted,#636980)"><span><span style="color:var(--text-secondary,#9aa0bb)">dalfox</span> v3.1.0</span><span><span style="color:var(--text-secondary,#9aa0bb)">xssmaze</span> v0.2.0</span><span>generated 2026-06-20</span></div></div><div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(9rem,1fr));gap:.75rem;margin:1rem 0"><div style="padding:.85rem 1rem;background:var(--bg-surface,#11141f);border:1px solid var(--border-light,#222741);border-radius:10px"><div style="font-size:.7rem;font-weight:600;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted,#636980)">Endpoints</div><div style="margin-top:.3rem;font-size:1.5rem;font-weight:700;line-height:1;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">1036</div><div style="margin-top:.35rem;font-size:.75rem;color:var(--text-secondary,#9aa0bb)">catalogued</div></div><div style="padding:.85rem 1rem;background:var(--bg-surface,#11141f);border:1px solid var(--border-light,#222741);border-radius:10px"><div style="font-size:.7rem;font-weight:600;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted,#636980)">Categories</div><div style="margin-top:.3rem;font-size:1.5rem;font-weight:700;line-height:1;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">171</div><div style="margin-top:.35rem;font-size:.75rem;color:var(--text-secondary,#9aa0bb)">test groups</div></div><div style="padding:.85rem 1rem;background:var(--bg-surface,#11141f);border:1px solid var(--border-light,#222741);border-radius:10px"><div style="font-size:.7rem;font-weight:600;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted,#636980)">Fully detected</div><div style="margin-top:.3rem;font-size:1.5rem;font-weight:700;line-height:1;color:#34d399;font-variant-numeric:tabular-nums">162</div><div style="margin-top:.35rem;font-size:.75rem;color:var(--text-secondary,#9aa0bb)">categories at 100%</div></div><div style="padding:.85rem 1rem;background:var(--bg-surface,#11141f);border:1px solid var(--border-light,#222741);border-radius:10px"><div style="font-size:.7rem;font-weight:600;text-transform:uppercase;letter-spacing:.08em;color:var(--text-muted,#636980)">With gaps</div><div style="margin-top:.3rem;font-size:1.5rem;font-weight:700;line-height:1;color:#f59e0b;font-variant-numeric:tabular-nums">9</div><div style="margin-top:.35rem;font-size:.75rem;color:var(--text-secondary,#9aa0bb)">below 100%</div></div></div>

### Coverage by category

**162 of 171** categories detect every endpoint. The chart highlights the **9** with gaps (worst first); the full breakdown is in the table.

<div style="margin:1.1rem 0"><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">jf</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:0.0%;background:#f87171"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">0/1 · 0.0%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">xsleak</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:0.0%;background:#f87171"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">0/5 · 0.0%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">storedpat</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:16.7%;background:#f87171"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">1/6 · 16.7%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">json</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:66.7%;background:#f59e0b"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">4/6 · 66.7%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">edgefilter</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:83.3%;background:#8b94e8"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">5/6 · 83.3%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">encodingedge</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:83.3%;background:#8b94e8"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">5/6 · 83.3%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">modern</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:84.4%;background:#8b94e8"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">27/32 · 84.4%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">bugbounty</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:90.0%;background:#34d399"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">9/10 · 90.0%</span></div><div style="display:flex;align-items:center;gap:.75rem;padding:.4rem 0"><span style="flex:0 1 10rem;font-family:var(--font-mono,ui-monospace,monospace);font-size:.82rem;color:var(--text-secondary,#9aa0bb);overflow:hidden;text-overflow:ellipsis;white-space:nowrap">prototype</span><span style="flex:1 1 auto;min-width:3rem;height:.5rem;background:var(--bg-body,#070811);border-radius:999px;overflow:hidden"><span style="display:block;height:100%;width:90.0%;background:#34d399"></span></span><span style="flex:0 0 6.5rem;text-align:right;font-size:.8rem;color:var(--text-primary,#e7e9f3);font-variant-numeric:tabular-nums">9/10 · 90.0%</span></div></div>

| Category | Endpoints | Detected | Verified | Rate |
| --- | ---: | ---: | ---: | ---: |
| `advanced` | 6 | 6 | 0 | 100.0% |
| `api` | 6 | 6 | 0 | 100.0% |
| `apidom` | 6 | 6 | 0 | 100.0% |
| `ariaattr` | 6 | 6 | 0 | 100.0% |
| `attr` | 6 | 6 | 0 | 100.0% |
| `attrctx` | 6 | 6 | 0 | 100.0% |
| `attrname` | 4 | 4 | 0 | 100.0% |
| `basic` | 7 | 7 | 0 | 100.0% |
| `booleanattr` | 6 | 6 | 0 | 100.0% |
| `browser` | 5 | 5 | 0 | 100.0% |
| `callback` | 4 | 4 | 0 | 100.0% |
| `casemanip` | 6 | 6 | 0 | 100.0% |
| `chain` | 6 | 6 | 0 | 100.0% |
| `channel` | 4 | 4 | 0 | 100.0% |
| `charlimit` | 6 | 6 | 0 | 100.0% |
| `clientstate` | 6 | 6 | 0 | 100.0% |
| `clipboard` | 4 | 4 | 0 | 100.0% |
| `cmspattern` | 6 | 6 | 0 | 100.0% |
| `codeexec` | 6 | 6 | 0 | 100.0% |
| `commentinj` | 6 | 6 | 0 | 100.0% |
| `complexpage` | 6 | 6 | 0 | 100.0% |
| `condreflect` | 6 | 6 | 0 | 100.0% |
| `csp` | 5 | 5 | 0 | 100.0% |
| `cspbypass` | 6 | 6 | 0 | 100.0% |
| `css` | 6 | 6 | 0 | 100.0% |
| `csti` | 5 | 5 | 0 | 100.0% |
| `ctxescape` | 8 | 8 | 0 | 100.0% |
| `ctxv2` | 6 | 6 | 0 | 100.0% |
| `ctype` | 6 | 6 | 0 | 100.0% |
| `customtag` | 6 | 6 | 0 | 100.0% |
| `dashboard` | 6 | 6 | 0 | 100.0% |
| `dataattr` | 6 | 6 | 0 | 100.0% |
| `dataurl` | 4 | 4 | 0 | 100.0% |
| `dblenc` | 4 | 4 | 0 | 100.0% |
| `decode` | 4 | 4 | 0 | 100.0% |
| `dialog` | 5 | 5 | 0 | 100.0% |
| `dom` | 38 | 38 | 0 | 100.0% |
| `domctx` | 6 | 6 | 0 | 100.0% |
| `doublereflect` | 6 | 6 | 0 | 100.0% |
| `dragdrop` | 4 | 4 | 0 | 100.0% |
| `ecommerce` | 6 | 6 | 0 | 100.0% |
| `edge` | 8 | 8 | 0 | 100.0% |
| `email` | 6 | 6 | 0 | 100.0% |
| `embedctx` | 6 | 6 | 0 | 100.0% |
| `encmix` | 6 | 6 | 0 | 100.0% |
| `encoding` | 8 | 8 | 0 | 100.0% |
| `errhandling` | 6 | 6 | 0 | 100.0% |
| `errpage` | 6 | 6 | 0 | 100.0% |
| `eventhandler` | 5 | 5 | 0 | 100.0% |
| `filterchain` | 8 | 8 | 0 | 100.0% |
| `formaction` | 4 | 4 | 0 | 100.0% |
| `formelement` | 6 | 6 | 0 | 100.0% |
| `fragment` | 6 | 6 | 0 | 100.0% |
| `fwoutput` | 6 | 6 | 0 | 100.0% |
| `globalattr` | 6 | 6 | 0 | 100.0% |
| `header` | 4 | 4 | 0 | 100.0% |
| `headerinj` | 6 | 6 | 0 | 100.0% |
| `headless` | 6 | 6 | 0 | 100.0% |
| `hidden` | 9 | 9 | 0 | 100.0% |
| `history` | 2 | 2 | 0 | 100.0% |
| `hpp` | 4 | 4 | 0 | 100.0% |
| `html5` | 8 | 8 | 0 | 100.0% |
| `htmlunsafe` | 6 | 6 | 0 | 100.0% |
| `import` | 6 | 6 | 0 | 100.0% |
| `inattr` | 6 | 6 | 0 | 100.0% |
| `inframe` | 4 | 4 | 0 | 100.0% |
| `injs` | 6 | 6 | 0 | 100.0% |
| `inlinestyle` | 6 | 6 | 0 | 100.0% |
| `inputtransform` | 6 | 6 | 0 | 100.0% |
| `jquery` | 6 | 6 | 0 | 100.0% |
| `jsctx` | 6 | 6 | 0 | 100.0% |
| `jsescape` | 6 | 6 | 0 | 100.0% |
| `jsonctx` | 6 | 6 | 0 | 100.0% |
| `latereflect` | 6 | 6 | 0 | 100.0% |
| `linkcontext` | 6 | 6 | 0 | 100.0% |
| `listiteration` | 6 | 6 | 0 | 100.0% |
| `manifest` | 1 | 1 | 0 | 100.0% |
| `markdown` | 6 | 6 | 0 | 100.0% |
| `mathml` | 3 | 3 | 0 | 100.0% |
| `mediacontext` | 6 | 6 | 0 | 100.0% |
| `metarefresh` | 4 | 4 | 0 | 100.0% |
| `microdata` | 6 | 6 | 0 | 100.0% |
| `misc` | 6 | 6 | 0 | 100.0% |
| `mixedmethod` | 6 | 6 | 0 | 100.0% |
| `mobserver` | 4 | 4 | 0 | 100.0% |
| `multicontext` | 6 | 6 | 0 | 100.0% |
| `multiline` | 6 | 6 | 0 | 100.0% |
| `multiparam` | 6 | 6 | 0 | 100.0% |
| `multipart` | 4 | 4 | 0 | 100.0% |
| `multipleoutput` | 6 | 6 | 0 | 100.0% |
| `multireflect` | 8 | 8 | 0 | 100.0% |
| `multivector` | 6 | 6 | 0 | 100.0% |
| `mutfilter` | 6 | 6 | 0 | 100.0% |
| `mxss` | 5 | 5 | 0 | 100.0% |
| `navsink` | 6 | 6 | 0 | 100.0% |
| `nestedctx` | 6 | 6 | 0 | 100.0% |
| `nestedfilter` | 6 | 6 | 0 | 100.0% |
| `nonce` | 4 | 4 | 0 | 100.0% |
| `noscript` | 4 | 4 | 0 | 100.0% |
| `numericcontext` | 6 | 6 | 0 | 100.0% |
| `obfuscation` | 6 | 6 | 0 | 100.0% |
| `opener` | 2 | 2 | 0 | 100.0% |
| `partialencode` | 6 | 6 | 0 | 100.0% |
| `path` | 4 | 4 | 0 | 100.0% |
| `pathxss` | 6 | 6 | 0 | 100.0% |
| `payloadfilt` | 6 | 6 | 0 | 100.0% |
| `pdiff` | 6 | 6 | 0 | 100.0% |
| `polyctx` | 6 | 6 | 0 | 100.0% |
| `polyglot` | 3 | 3 | 0 | 100.0% |
| `popover` | 3 | 3 | 0 | 100.0% |
| `post` | 2 | 2 | 0 | 100.0% |
| `postmethod` | 6 | 6 | 0 | 100.0% |
| `racecon` | 4 | 4 | 0 | 100.0% |
| `realworld` | 16 | 16 | 0 | 100.0% |
| `realworld_input` | 8 | 8 | 0 | 100.0% |
| `recfilt` | 6 | 6 | 0 | 100.0% |
| `redirect` | 4 | 4 | 0 | 100.0% |
| `redirectxss` | 6 | 6 | 0 | 100.0% |
| `referrer` | 2 | 2 | 0 | 100.0% |
| `regexbypass` | 8 | 8 | 0 | 100.0% |
| `regexfilt` | 6 | 6 | 0 | 100.0% |
| `reparse` | 5 | 5 | 0 | 100.0% |
| `replacementfilter` | 6 | 6 | 0 | 100.0% |
| `respheader` | 6 | 6 | 0 | 100.0% |
| `rsplit` | 4 | 4 | 0 | 100.0% |
| `rwpattern` | 6 | 6 | 0 | 100.0% |
| `sanitizer` | 12 | 12 | 0 | 100.0% |
| `scanbounty` | 8 | 8 | 0 | 100.0% |
| `scriptgadget` | 6 | 6 | 0 | 100.0% |
| `semantictag` | 6 | 6 | 0 | 100.0% |
| `seoctx` | 6 | 6 | 0 | 100.0% |
| `service` | 2 | 2 | 0 | 100.0% |
| `shadow` | 5 | 5 | 0 | 100.0% |
| `sink` | 8 | 8 | 0 | 100.0% |
| `slot` | 4 | 4 | 0 | 100.0% |
| `social` | 6 | 6 | 0 | 100.0% |
| `specialchar` | 6 | 6 | 0 | 100.0% |
| `specialtag` | 8 | 8 | 0 | 100.0% |
| `srcdoc` | 5 | 5 | 0 | 100.0% |
| `srcset` | 4 | 4 | 0 | 100.0% |
| `storage` | 2 | 2 | 0 | 100.0% |
| `stored` | 4 | 4 | 0 | 100.0% |
| `stream` | 3 | 3 | 0 | 100.0% |
| `svg` | 6 | 6 | 0 | 100.0% |
| `svgctx` | 6 | 6 | 0 | 100.0% |
| `tablecontext` | 6 | 6 | 0 | 100.0% |
| `tagattrmix` | 6 | 6 | 0 | 100.0% |
| `template` | 6 | 6 | 0 | 100.0% |
| `timing` | 6 | 6 | 0 | 100.0% |
| `tplel` | 4 | 4 | 0 | 100.0% |
| `tplinject` | 6 | 6 | 0 | 100.0% |
| `truncation` | 6 | 6 | 0 | 100.0% |
| `trustedtypes` | 5 | 5 | 0 | 100.0% |
| `unicode` | 6 | 6 | 0 | 100.0% |
| `url` | 6 | 6 | 0 | 100.0% |
| `waf` | 16 | 16 | 0 | 100.0% |
| `wafv2` | 6 | 6 | 0 | 100.0% |
| `websocket` | 7 | 7 | 0 | 100.0% |
| `whitespace` | 6 | 6 | 0 | 100.0% |
| `worker` | 4 | 4 | 0 | 100.0% |
| `wrappercontext` | 6 | 6 | 0 | 100.0% |
| `xmlctx` | 6 | 6 | 0 | 100.0% |
| `bugbounty` | 10 | 9 | 0 | 90.0% |
| `prototype` | 10 | 9 | 0 | 90.0% |
| `modern` | 32 | 27 | 0 | 84.4% |
| `edgefilter` | 6 | 5 | 0 | 83.3% |
| `encodingedge` | 6 | 5 | 0 | 83.3% |
| `json` | 6 | 4 | 0 | 66.7% |
| `storedpat` | 6 | 1 | 0 | 16.7% |
| `jf` | 1 | 0 | 0 | 0.0% |
| `xsleak` | 5 | 0 | 0 | 0.0% |
| **Total** | **1036** | **1014** | **0** | **97.9%** |

_Generated 2026-06-20T12:16:01Z · image `ghcr.io/hahwul/xssmaze:main` (`ghcr.io/hahwul/xssmaze@sha256:9311b1693a75b72310a53852f72616e2bf11282a4b53cd2fe5fdf114aba0fb30`) · run `just xssmaze-score` to refresh._

<!-- XSSMAZE:END -->

## Methodology

- **Targets:** every endpoint returned by XSSMaze's `/map/json`, grouped by its catalog `type` (category).
- **Per-endpoint scan:** Dalfox is pointed at the exact injection point the catalog declares (`query`, body, header, or path), with parameter mining disabled (`--skip-mining`); discovery and reflection checks stay on so header/path cases still resolve.
- **Detected:** an endpoint counts as detected when Dalfox returns at least one finding (verified, reflected, or AST-DOM).
- **Verified:** the subset where Dalfox confirmed execution in the parsed DOM (finding type `V`).
- **Rate:** `detected / endpoints`, per category and overall.

Each snapshot is pinned to the Dalfox version that produced it and the exact XSSMaze image digest, both shown beneath the table. The raw data lives in [`docs/data/xssmaze-score.json`](https://github.com/hahwul/dalfox/blob/main/docs/data/xssmaze-score.json).

## Reading the numbers

A high rate in a category means Dalfox reliably reaches and confirms those sinks; a low rate flags contexts worth investing in next. Because the scan targets the known injection point and skips mining, this measures Dalfox's **detection and verification** capability rather than its parameter-discovery breadth; discovery is exercised separately by the functional test suite. Scores move as both Dalfox and XSSMaze evolve, so always read them alongside the versions stamped under the table.
