Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Hunt CRLF injection in parameterized URLs

Find HTTP response splitting in parameterized URLs.

Agent
Test parameterized URLs for CRLF injectionRun custom payloadsPace requests against sensitive targets

overview

What crlfmap does

crlfmap injects carriage-return and line-feed sequences into parameters and watches whether they reach response headers. That reflection is the path to header forgery, cookie sets, and cache poisoning.

Point -d at a file of parameterized domains from a crawler or archive source, enable scan mode, and optionally load --payloads. --threads, --timeout, and --delay pace the run; --slack-webhook can push findings.

Reach for it when CRLF and HTTP splitting are the question on a param URL set. Prefer crlfuzz for a lighter URL-list pass; run nuclei when you need many vulnerability classes at once.

source github.com/ryandamour/crlfmap

use cases

Where crlfmap fits

Test parameterized URLs for CRLF injection

Feed a list of domains with parameters via -d and crlfmap injects line-break sequences to find where they leak into response headers.

Run custom payloads

Point --payloads at your own list to cover encodings and bypasses the default set misses, useful against filtered targets.

Pace requests against sensitive targets

Set --threads, --timeout, and --delay so the scan stays within a target's tolerance during a wide run.

Alert on findings

Send results to a Slack webhook with --slack-webhook so a scheduled scan notifies the team when a splittable parameter appears.

reference

crlfmap inputs and flags

9 inputs
NameTypeFlagDescription
target-domainsFILE-dLocation of domains with parameters to scan.
scan-modeBOOLEANscanRun the tool in scan mode.
payloadsFILE--payloadsLocation of payloads to generate on requests (default payloads.txt).
threadsSTRING--threadsNumber of threads to run crlfmap on (default 1).
timeoutSTRING--timeoutTime before closing a connection that could be hung (default 10).
delay-milisecSTRING--delayTime each thread waits between requests, in milliseconds.
user-agentSTRING--user-agentUser agent string for requests.
slack-webhookSTRING--slack-webhookSlack webhook to send findings to a channel.

Showing key inputs. crlfmap exposes 9 inputs in total.

Full flag reference (9 inputs)
NameTypeFlagDescription
threadsSTRING--threadsNumber of threads to run crlfmap on (default 1)
timeoutSTRING--timeoutThe amount of time needed to close a connection that could be hung (default 10)
verboseBOOLEAN--verboseVerbose output.
payloadsFILE--payloadsLocation of payloads to generate on requests (default "payloads.txt")
scan-modeBOOLEANscanScan mode
user-agentSTRING--user-agentUser agent for requests (default "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36")
delay-milisecSTRING--delayThe time each threads waits between requests in milliseconds
slack-webhookSTRING--slack-webhookSlack webhook to send findings to a channel
target-domainsFILE-dLocation of domains with parameters to scan

example

Run crlfmap

crlfmap · command
# scan parameterized URLs for CRLF / HTTP splittingcrlfmap scan -d targets.txt --payloads payloads.txt --threads 4 --delay 200 --timeout 10
sample output
[VULN] https://www.example.com/search?q=test%0d%0aSet-Cookie:crlf=1[VULN] https://api.example.com/v1/redirect?url=https://example.com%0d%0aX-Injected:1[INFO] scanned 128 targets with 12 payloads[INFO] threads=4 delay=200ms timeout=10s[VULN] https://app.example.com/login?next=%0d%0aLocation:%20https://evil.example[DONE] 3 vulnerable parameters written

guidance

Choosing crlfmap

Use crlfmap to test parameterized URLs for CRLF injection and HTTP splitting. Prefer crlfuzz for a lighter Go URL-list pass. Run nuclei when you need broad coverage beyond CRLF.

crlfuzz

Go CRLF scanner for URL lists. Lighter pacing surface than crlfmap.

nuclei

Template-driven scanner with CRLF among many checks. Broader, less focused.

dalfox

Parameter analysis and XSS scanner. Complements crlfmap on the same parameterized URLs.

faq

crlfmap questions

CRLF injection that leads to HTTP response splitting. It injects line-break sequences into parameters and checks whether they appear in response headers.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run crlfmap yourself

A list of parameterized URLs feeds CRLFMap, which injects CRLF payloads and writes the splittable parameters it finds as a queryable output.

Run crlfmap in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.