How do I run it on a single URL?

Pass the URL with -u, for example `crlfuzz -u https://example.com/redirect?url=test`. On Trickest, set the url-to-fuzz input instead of the flag.

Can it scan a full list of URLs?

Yes. Give it a file with -l. Raise or lower -c from the default of 25 to match target tolerance.

How do I keep only vulnerable targets?

Use -s so output contains only URLs that confirmed an injection, which keeps wide runs readable for triage.

Can I test POST requests or send custom headers?

Yes. Set -X for the method, -d for request data, and -H for a header such as a session cookie.

How does crlfuzz differ from ffuf or nuclei?

crlfuzz fuzzes only for CRLF injection. ffuf is a general content and parameter fuzzer; nuclei runs templated checks across many bug classes.

Updated Jul 14, 2026

Misconfiguration

Test URLs for CRLF injection and header splits

Go-based CRLF injection scanner for URLs and URL lists.

Scan a URL list for CRLF injection Report only vulnerable targets Test POST and custom requests

overview

What crlfuzz does

crlfuzz appends encoded line-break payloads to requests and checks whether injection reaches the response header block. Point -u at one URL or -l at a file of URLs.

Dial concurrency with -c. -X, -d, and -H reach non-GET or authenticated parameters; -x routes through a proxy. -s keeps only confirmed vulnerable targets in the output.

Use it as the focused CRLF pass after a crawler gathers candidates. Prefer crlfmap when you need per-thread delay and Slack alerts; pair with nuclei or dalfox for other injection classes.

source github.com/dwisiswant0/crlfuzz

use cases

Where crlfuzz fits

Scan a URL list for CRLF injection

Feed a file of collected URLs with -l and crlfuzz tests each one for line-break injection into response headers, fast enough to cover a wide scope.

Report only vulnerable targets

Turn on -s so a large run returns only the URLs that confirmed an injection, giving you a clean list to triage or hand to the next node.

Test POST and custom requests

Supply request data with -d, a method with -X, and headers with -H to reach parameters that only exist on non-GET requests or behind authentication.

Tune throughput to the target

Raise or lower -c to balance speed against a target's tolerance, and send traffic through -x when you need to inspect requests in a proxy.

reference

crlfuzz inputs and flags

8 inputs

Name	Type	Flag	Description
url-to-fuzz	STRING	-u	Define a single URL to fuzz.
url-list-to-fuzz	FILE	-l	Fuzz every URL within a file.
only-vulnerable-targets	BOOLEAN	-s	Show only vulnerable targets in the output.
concurrency-level	STRING	-c	Set the concurrency level (default 25).
method-to-use	STRING	-X	Request method to use (default GET).
Request-data	STRING	-d	Define request data for POST-style tests.
custom-header	STRING	-H	Pass a custom header to the target.
Proxy	STRING	-x	Route requests through a specified proxy.

Showing key inputs. crlfuzz exposes 8 inputs in total.

example

Run crlfuzz

crlfuzz · command

# fuzz a list of collected URLs and keep only confirmed CRLF injectionscrlfuzz -l urls.txt -c 40 -s -o crlf-findings.txt

sample output

crlfuzz v1.4.1[https://github.com/dwisiswant0/crlfuzz] [VLN] https://example.com/%0d%0aSet-Cookie:crlf=1[VLN] https://app.example.com/r?url=%0d%0aLocation:https://198.51.100.24[NON] https://example.com/about[NON] https://api.example.com/v1/health[NON] https://staging.example.com/login

guidance

Choosing crlfuzz

Use crlfuzz for CRLF injection checks on a single URL or a URL list. Prefer crlfmap when you need request delay and Slack alerting. Pair with nuclei or dalfox for other injection classes on the same URLs.

crlfmap

CRLF and HTTP-splitting scanner with per-thread delay and Slack alerts. More pacing controls.

nuclei

Template-driven scanner with CRLF among many checks. Broader coverage, less focused.

dalfox

Parameter analysis and XSS scanner. Complements crlfuzz on the same parameterized URLs.

faq

crlfuzz questions

CRLF injection where unescaped carriage-return (%0d) and line-feed (%0a) bytes in a parameter break into HTTP response headers. That can enable response splitting, header injection, and related abuse.

Run crlfuzz yourself

A URL list feeds crlfuzz, which fuzzes each request for CRLF injection and writes the vulnerable targets as a queryable output.

Open crlfuzz in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.