How do I point it at targets?

Pass a file of domains with parameters using -d and enable scan mode, for example `crlfmap scan -d targets.txt --threads 4`.

Can I use my own payloads?

Yes. Point --payloads at a custom file to cover encodings and bypasses the default payloads.txt set misses.

How is crlfmap different from crlfuzz?

crlfuzz is a Go scanner for URL lists with concurrency flags. crlfmap centers on parameterized domain files, custom payload files, request delay, and optional Slack alerts.

How do I slow the scan down?

Lower --threads, raise --timeout for hung connections, and set --delay in milliseconds so each thread waits between requests.

How do I get notified of findings?

Set --slack-webhook to a channel webhook and crlfmap pushes results as it scans.

Updated Jul 15, 2026

Vulnerabilities

Hunt CRLF injection in parameterized URLs

Find HTTP response splitting in parameterized URLs.

Test parameterized URLs for CRLF injection Run custom payloads Pace requests against sensitive targets

overview

What crlfmap does

crlfmap injects carriage-return and line-feed sequences into parameters and watches whether they reach response headers. That reflection is the path to header forgery, cookie sets, and cache poisoning.

Point -d at a file of parameterized domains from a crawler or archive source, enable scan mode, and optionally load --payloads. --threads, --timeout, and --delay pace the run; --slack-webhook can push findings.

Reach for it when CRLF and HTTP splitting are the question on a param URL set. Prefer crlfuzz for a lighter URL-list pass; run nuclei when you need many vulnerability classes at once.

source github.com/ryandamour/crlfmap

use cases

Where crlfmap fits

Test parameterized URLs for CRLF injection

Feed a list of domains with parameters via -d and crlfmap injects line-break sequences to find where they leak into response headers.

Run custom payloads

Point --payloads at your own list to cover encodings and bypasses the default set misses, useful against filtered targets.

Pace requests against sensitive targets

Set --threads, --timeout, and --delay so the scan stays within a target's tolerance during a wide run.

Alert on findings

Send results to a Slack webhook with --slack-webhook so a scheduled scan notifies the team when a splittable parameter appears.

reference

crlfmap inputs and flags

9 inputs

Name	Type	Flag	Description
target-domains	FILE	-d	Location of domains with parameters to scan.
scan-mode	BOOLEAN	scan	Run the tool in scan mode.
payloads	FILE	--payloads	Location of payloads to generate on requests (default payloads.txt).
threads	STRING	--threads	Number of threads to run crlfmap on (default 1).
timeout	STRING	--timeout	Time before closing a connection that could be hung (default 10).
delay-milisec	STRING	--delay	Time each thread waits between requests, in milliseconds.
user-agent	STRING	--user-agent	User agent string for requests.
slack-webhook	STRING	--slack-webhook	Slack webhook to send findings to a channel.

Showing key inputs. crlfmap exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
threads	STRING	--threads	Number of threads to run crlfmap on (default 1)
timeout	STRING	--timeout	The amount of time needed to close a connection that could be hung (default 10)
verbose	BOOLEAN	--verbose	Verbose output.
payloads	FILE	--payloads	Location of payloads to generate on requests (default "payloads.txt")
scan-mode	BOOLEAN	scan	Scan mode
user-agent	STRING	--user-agent	User agent for requests (default "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36")
delay-milisec	STRING	--delay	The time each threads waits between requests in milliseconds
slack-webhook	STRING	--slack-webhook	Slack webhook to send findings to a channel
target-domains	FILE	-d	Location of domains with parameters to scan

example

Run crlfmap

crlfmap · command

# scan parameterized URLs for CRLF / HTTP splittingcrlfmap scan -d targets.txt --payloads payloads.txt --threads 4 --delay 200 --timeout 10

sample output

[VULN] https://www.example.com/search?q=test%0d%0aSet-Cookie:crlf=1[VULN] https://api.example.com/v1/redirect?url=https://example.com%0d%0aX-Injected:1[INFO] scanned 128 targets with 12 payloads[INFO] threads=4 delay=200ms timeout=10s[VULN] https://app.example.com/login?next=%0d%0aLocation:%20https://evil.example[DONE] 3 vulnerable parameters written

guidance

Choosing crlfmap

Use crlfmap to test parameterized URLs for CRLF injection and HTTP splitting. Prefer crlfuzz for a lighter Go URL-list pass. Run nuclei when you need broad coverage beyond CRLF.

crlfuzz

Go CRLF scanner for URL lists. Lighter pacing surface than crlfmap.

nuclei

Template-driven scanner with CRLF among many checks. Broader, less focused.

dalfox

Parameter analysis and XSS scanner. Complements crlfmap on the same parameterized URLs.

faq

crlfmap questions

CRLF injection that leads to HTTP response splitting. It injects line-break sequences into parameters and checks whether they appear in response headers.

Run crlfmap yourself

A list of parameterized URLs feeds CRLFMap, which injects CRLF payloads and writes the splittable parameters it finds as a queryable output.

Run crlfmap in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target-domains

FILE

-d

Location of domains with parameters to scan.

scan-mode

BOOLEAN

scan

Run the tool in scan mode.

payloads

FILE

--payloads

Location of payloads to generate on requests (default payloads.txt).

threads

STRING

--threads

Number of threads to run crlfmap on (default 1).

timeout

STRING

--timeout

Time before closing a connection that could be hung (default 10).

delay-milisec

STRING

--delay

Time each thread waits between requests, in milliseconds.

user-agent

STRING

--user-agent

User agent string for requests.

slack-webhook

STRING

--slack-webhook

Slack webhook to send findings to a channel.

Name

Type

Flag

Description

threads

STRING

--threads

Number of threads to run crlfmap on (default 1)

timeout

STRING

--timeout

The amount of time needed to close a connection that could be hung (default 10)

verbose

BOOLEAN

--verbose

Verbose output.

payloads

FILE

--payloads

Location of payloads to generate on requests (default "payloads.txt")

scan-mode

BOOLEAN

scan

Scan mode

user-agent

STRING

--user-agent

User agent for requests (default "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36")

delay-milisec

STRING

--delay

The time each threads waits between requests in milliseconds

slack-webhook

STRING

--slack-webhook

Slack webhook to send findings to a channel

target-domains

FILE

-d

Location of domains with parameters to scan

[VULN] https://www.example.com/search?q=test%0d%0aSet-Cookie:crlf=1[VULN] https://api.example.com/v1/redirect?url=https://example.com%0d%0aX-Injected:1[INFO] scanned 128 targets with 12 payloads[INFO] threads=4 delay=200ms timeout=10s[VULN] https://app.example.com/login?next=%0d%0aLocation:%20https://evil.example[DONE] 3 vulnerable parameters written

Hunt CRLF injection in parameterized URLs

What crlfmap does

Where crlfmap fits

Test parameterized URLs for CRLF injection

Run custom payloads

Pace requests against sensitive targets

Alert on findings

crlfmap inputs and flags

Run crlfmap

Choosing crlfmap

crlfuzz

nuclei

dalfox

crlfmap questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run crlfmap yourself

Hunt CRLF injection in parameterized URLs

What crlfmap does

Where crlfmap fits

Test parameterized URLs for CRLF injection

Run custom payloads

Pace requests against sensitive targets

Alert on findings

crlfmap inputs and flags

Run crlfmap

Choosing crlfmap

crlfuzz

nuclei

dalfox

crlfmap questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run crlfmap yourself