How do I run crlfuzz on a single URL?

Pass the URL with -u, for example `crlfuzz -u https://example.com/redirect?url=test`. crlfuzz mutates the parameter with CRLF payloads and prints the URL if the response header block reflects them. On Trickest, set the node's url-to-fuzz input instead of the flag.

Can crlfuzz scan a full list of URLs?

Yes. Give it a file with -l and it fuzzes every URL in turn, the usual way to run it against a crawled scope. Raise -c to lift concurrency above the default of 25 when the target can take the load. It also reads URLs from stdin, so you can pipe a URL collector straight into it.

How do I keep only the vulnerable targets?

Use -s so crlfuzz prints only the URLs that confirmed an injection and drops the non-vulnerable ones. That keeps a wide run readable and gives you a clean list to triage or feed to the next node. To save it, add the upstream -o flag with a file path.

Can I test POST requests or send custom headers?

Yes. Set -X to change the method, -d to carry request data, and -H to add a header such as a session cookie or a custom user agent. Together they reach parameters that only appear on non-GET requests or behind authentication.

Is crlfuzz a general fuzzer like ffuf or nuclei?

No. crlfuzz does one job: it fuzzes for CRLF injection specifically. ffuf is a content and parameter fuzzer, and nuclei runs templated checks across many bug classes. Reach for crlfuzz when CRLF and response splitting are the target, and pair it with nuclei or dalfox to cover other injection types on the same URLs.

Updated Jul 14, 2026

Misconfiguration

Scan URLs for CRLF injection and response splitting

A fast tool to scan for CRLF vulnerabilities, written in Go.

Scan a URL list for CRLF injection Report only vulnerable targets Test POST and custom requests

overview

What crlfuzz does

crlfuzz tests web targets for CRLF injection, the flaw that lets an attacker smuggle carriage-return and line-feed bytes into a response and split its headers. It appends encoded line-break payloads to a request, then inspects the response to see whether the injection reached the header block. Written in Go, it clears a single URL or a large list at speed with the same flags.

It drops into attack-surface automation without ceremony. Point it at one URL with -u or a file of URLs with -l, dial the concurrency with -c, and route traffic through -x when you want to watch requests in a proxy. -d, -X, and -H carry request data, switch methods, and add headers so you can reach parameters that only surface on POST or behind auth.

On Trickest, crlfuzz is a Misconfiguration node that takes a URL or a URL list and writes a file and a folder of results. Run it after a crawler or URL collector has gathered links worth testing, and set -s so the output holds only the targets that confirmed an injection.

source github.com/dwisiswant0/crlfuzz

use cases

Where crlfuzz fits

Scan a URL list for CRLF injection

Feed a file of collected URLs with -l and crlfuzz tests each one for line-break injection into response headers, fast enough to cover a wide scope.

Report only vulnerable targets

Turn on -s so a large run returns only the URLs that confirmed an injection, giving you a clean list to triage or hand to the next node.

Test POST and custom requests

Supply request data with -d, a method with -X, and headers with -H to reach parameters that only exist on non-GET requests or behind authentication.

Tune throughput to the target

Raise or lower -c to balance speed against a target's tolerance, and send traffic through -x when you need to inspect requests in a proxy.

reference

crlfuzz inputs and flags

8 inputs

Name	Type	Flag	Description
url-to-fuzz	STRING	-u	Define a single URL to fuzz.
url-list-to-fuzz	FILE	-l	Fuzz every URL within a file.
only-vulnerable-targets	BOOLEAN	-s	Show only vulnerable targets in the output.
concurrency-level	STRING	-c	Set the concurrency level (default 25).
method-to-use	STRING	-X	Request method to use (default GET).
Request-data	STRING	-d	Define request data for POST-style tests.
custom-header	STRING	-H	Pass a custom header to the target.
Proxy	STRING	-x	Route requests through a specified proxy.

Showing key inputs. crlfuzz exposes 8 inputs in total.

example

Run crlfuzz

crlfuzz · command

# fuzz a list of collected URLs and keep only confirmed CRLF injectionscrlfuzz -l urls.txt -c 40 -s -o crlf-findings.txt

sample output

crlfuzz v1.4.1[https://github.com/dwisiswant0/crlfuzz] [VLN] https://example.com/%0d%0aSet-Cookie:crlf=1[VLN] https://app.example.com/r?url=%0d%0aLocation:https://198.51.100.24[NON] https://example.com/about[NON] https://api.example.com/v1/health[NON] https://staging.example.com/login

guidance

Choosing crlfuzz

Use crlfuzz for fast CRLF injection scanning across a single URL or a large list. It is the quicker Go-based option; CRLFMap adds pacing and Slack alerting if you need them. Pair it with dalfox or nuclei to cover other injection classes on the same URLs.

crlfmap

CRLF and HTTP-splitting scanner with per-thread delay and Slack alerts. Slower, more pacing controls.

nuclei

Template-driven scanner with CRLF templates among many. Broader coverage, less focused.

dalfox

Parameter analysis and XSS scanner. Complements crlfuzz on the same parameterized URLs.

faq

crlfuzz questions

CRLF injection: the bug where unescaped carriage-return (%0d) and line-feed (%0a) bytes in a parameter break out into the HTTP response headers. That opens HTTP response splitting, header injection, and sometimes cache poisoning or open redirects. crlfuzz appends encoded line-break payloads and reports the URLs where the injection reaches the response.

Run crlfuzz yourself

A URL list feeds crlfuzz, which fuzzes each request for CRLF injection and writes the vulnerable targets as a queryable output.

Run crlfuzz in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url-to-fuzz

STRING

-u

Define a single URL to fuzz.

url-list-to-fuzz

FILE

-l

Fuzz every URL within a file.

only-vulnerable-targets

BOOLEAN

-s

Show only vulnerable targets in the output.

concurrency-level

STRING

-c

Set the concurrency level (default 25).

method-to-use

STRING

-X

Request method to use (default GET).

Request-data

STRING

-d

Define request data for POST-style tests.

custom-header

STRING

-H

Pass a custom header to the target.

Proxy

STRING

-x

Route requests through a specified proxy.

crlfuzz v1.4.1[https://github.com/dwisiswant0/crlfuzz] [VLN] https://example.com/%0d%0aSet-Cookie:crlf=1[VLN] https://app.example.com/r?url=%0d%0aLocation:https://198.51.100.24[NON] https://example.com/about[NON] https://api.example.com/v1/health[NON] https://staging.example.com/login

Scan URLs for CRLF injection and response splitting

What crlfuzz does

Where crlfuzz fits

Scan a URL list for CRLF injection

Report only vulnerable targets

Test POST and custom requests

Tune throughput to the target

crlfuzz inputs and flags

Run crlfuzz

Choosing crlfuzz

crlfmap

nuclei

dalfox

crlfuzz questions

More Misconfiguration tools

gitjacker

hinject

snallygaster

subjack

Run crlfuzz yourself

Scan URLs for CRLF injection and response splitting

What crlfuzz does

Where crlfuzz fits

Scan a URL list for CRLF injection

Report only vulnerable targets

Test POST and custom requests

Tune throughput to the target

crlfuzz inputs and flags

Run crlfuzz

Choosing crlfuzz

crlfmap

nuclei

dalfox

crlfuzz questions

More Misconfiguration tools

gitjacker

hinject

snallygaster

subjack

Run crlfuzz yourself