{
  "id": 18790862,
  "title": "Finding XSS before attackers do: auditing your Laravel app with Kali",
  "url": "https://urgent.news/2026/11/07/finding-xss-before-attackers-do-auditing-your-laravel-app-with-kali",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T21:24:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/meledjearmel/finding-xss-before-attackers-do-auditing-your-laravel-app-with-kali-3pka"
  },
  "original_language": "en",
  "account": "Your application passes all its tests. However, hidden search fields can unknowingly echo typed text back on the page without filtering. Attackers don't have access to the code, but they explore the application, testing every parameter. In October, Kali Linux 2026.3 introduced two tools to help you audit your own applications: katana and dalfox (BleepingComputer). These tools should only be used on applications you control or with permission.\n\nKatana acts as a site crawler, following links, extracting JavaScript, and listing all reachable URLs and parameters. Run katana with the command \"katana -u https://staging.example.com -d 3 -o urls.txt.\" This list may reveal unexpected elements like outdated routes, accessible admin pages, or forgotten parameters.\n\nDalfox then focuses on testing these parameters. It injects payloads into each parameter in an attempt to expose an XSS vulnerability. Run dalfox with \"cat urls.txt | dalfox pipe -o results.txt.\" You can also target specific pages, such as \"dalfox url https://staging.example.com/search?q=test.\"\n\nKali's tools are available in Kali's repositories and the official Docker image. In Laravel, most flaws arise from not using Blade's {{ }} for escaping. XSS occurs when content escapes this frame: using {!! !!} for raw output, injecting data into inline JavaScript, generating HTML client-side with innerHTML from API data, or constructing attributes like href from user-supplied URLs (javascript:).\n\nThese tools send numerous requests with malicious data. Therefore, run them on a staging environment, not production with real data. Running katana and dalfox before each major release takes only a few minutes, significantly less than the time spent fixing an unsuspected flaw. Testing your application like an attacker removes the element of surprise from potential attackers.",
  "summary": "Your application passes all its tests. Forms validate data, Blade views escape what they display. Then one day, a forgotten search field echoes the typed text back into the page, unfiltered. Someone only had to try. Attackers don't have access to our code. They explore the application from the outside, page by page, and test every parameter. In late October, Kali Linux 2026.3 added two tools that…",
  "key_points": [
    "Katana crawls sites, extracts JS, lists URLs & parameters",
    "Dalfox tests parameters, injects payloads for XSS detection",
    "Run katana & dalfox on staging, not production, before releases"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}