loading
Loading content
loading
Misconfiguration
Go-based CRLF injection scanner for URLs and URL lists.
overview
crlfuzz appends encoded line-break payloads to requests and checks whether injection reaches the response header block. Point -u at one URL or -l at a file of URLs.
Dial concurrency with -c. -X, -d, and -H reach non-GET or authenticated parameters; -x routes through a proxy. -s keeps only confirmed vulnerable targets in the output.
Use it as the focused CRLF pass after a crawler gathers candidates. Prefer crlfmap when you need per-thread delay and Slack alerts; pair with nuclei or dalfox for other injection classes.
use cases
Feed a file of collected URLs with -l and crlfuzz tests each one for line-break injection into response headers, fast enough to cover a wide scope.
Turn on -s so a large run returns only the URLs that confirmed an injection, giving you a clean list to triage or hand to the next node.
Supply request data with -d, a method with -X, and headers with -H to reach parameters that only exist on non-GET requests or behind authentication.
Raise or lower -c to balance speed against a target's tolerance, and send traffic through -x when you need to inspect requests in a proxy.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url-to-fuzz | STRING | -u | Define a single URL to fuzz. |
| url-list-to-fuzz | FILE | -l | Fuzz every URL within a file. |
| only-vulnerable-targets | BOOLEAN | -s | Show only vulnerable targets in the output. |
| concurrency-level | STRING | -c | Set the concurrency level (default 25). |
| method-to-use | STRING | -X | Request method to use (default GET). |
| Request-data | STRING | -d | Define request data for POST-style tests. |
| custom-header | STRING | -H | Pass a custom header to the target. |
| Proxy | STRING | -x | Route requests through a specified proxy. |
Showing key inputs. crlfuzz exposes 8 inputs in total.
example
# fuzz a list of collected URLs and keep only confirmed CRLF injectionscrlfuzz -l urls.txt -c 40 -s -o crlf-findings.txtcrlfuzz v1.4.1[https://github.com/dwisiswant0/crlfuzz] [VLN] https://example.com/%0d%0aSet-Cookie:crlf=1[VLN] https://app.example.com/r?url=%0d%0aLocation:https://198.51.100.24[NON] https://example.com/about[NON] https://api.example.com/v1/health[NON] https://staging.example.com/loginguidance
Use crlfuzz for CRLF injection checks on a single URL or a URL list. Prefer crlfmap when you need request delay and Slack alerting. Pair with nuclei or dalfox for other injection classes on the same URLs.
CRLF and HTTP-splitting scanner with per-thread delay and Slack alerts. More pacing controls.
Template-driven scanner with CRLF among many checks. Broader coverage, less focused.
Parameter analysis and XSS scanner. Complements crlfuzz on the same parameterized URLs.
faq
A URL list feeds crlfuzz, which fuzzes each request for CRLF injection and writes the vulnerable targets as a queryable output.
Facts on this page come from the live Trickest tool library.