Finding XSS before attackers do: auditing your Laravel app with Kali

Your application passes all its tests. However, hidden search fields can unknowingly echo typed text back on the page without filtering. Attackers don't have access to the code, but they explore the application, testing every parameter. In October, Kali Linux 2026.3 introduced two tools to help you audit your own applications: katana and dalfox (BleepingComputer). These tools should only be used on applications you control or with permission.

Katana acts as a site crawler, following links, extracting JavaScript, and listing all reachable URLs and parameters. Run katana with the command "katana -u https://staging.example.com -d 3 -o urls.txt." This list may reveal unexpected elements like outdated routes, accessible admin pages, or forgotten parameters.

Dalfox then focuses on testing these parameters. It injects payloads into each parameter in an attempt to expose an XSS vulnerability. Run dalfox with "cat urls.txt | dalfox pipe -o results.txt." You can also target specific pages, such as "dalfox url https://staging.example.com/search?q=test."

Kali's tools are available in Kali's repositories and the official Docker image. In Laravel, most flaws arise from not using Blade's {{ }} for escaping. XSS occurs when content escapes this frame: using {!! !!} for raw output, injecting data into inline JavaScript, generating HTML client-side with innerHTML from API data, or constructing attributes like href from user-supplied URLs (javascript:).

These tools send numerous requests with malicious data. Therefore, run them on a staging environment, not production with real data. Running katana and dalfox before each major release takes only a few minutes, significantly less than the time spent fixing an unsuspected flaw. Testing your application like an attacker removes the element of surprise from potential attackers.