loading
Loading content
loading
Vulnerabilities
Python open-redirect and CRLF fuzzer for URLs and URL lists.
overview
Oralyzer fuzzes a target URL with redirect payloads and flags endpoints that forward the browser off-site. Point --url at one target or --list at a file of candidates collected upstream.
Enable -crlf to fold a CRLF header-injection pass into the same run. Supply --payload to control the redirect strings; --wayback pulls historical URLs from archive.org; --proxy routes traffic for inspection.
Place it after a crawler or archive miner that surfaces parameterized URLs. Prefer OpenRedireX for async open-redirect-only fuzzing; use crlfuzz when CRLF is the sole class under test.
use cases
Fuzz a target or a URL list with redirect payloads and flag the endpoints that forward the browser off-site to an attacker-controlled host.
Enable -crlf so the same run also checks for header-injection flaws, covering two URL-level classes in a single pass.
Turn on --wayback to source historical URLs from archive.org, reaching parameterized paths the live site no longer links.
Send requests through --proxy for inspection and supply a --payload file to test the exact redirect strings you care about.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Scan a single target URL. |
| url-list | FILE | --list | Scan multiple targets from a file. |
| payload | FILE | --payload | Use redirect payloads from a file. |
| crlf-test | BOOLEAN | -crlf | Also scan for CRLF injection. |
| wayback | BOOLEAN | --wayback | Fetch URLs from archive.org. |
| proxy | STRING | --proxy | Route requests through a proxy. |
Showing key inputs. oralyzer exposes 6 inputs in total.
example
# fuzz collected URLs for open redirect, with a CRLF passoralyzer --list urls.txt --payload payloads.txt -crlf[ Oralyzer ] [i] Payloads loaded: 58[i] Target: https://example.com/out?url=FUZZ [+] Open Redirect: https://example.com/out?url=//203.0.113.10[+] Open Redirect: https://example.com/out?url=/%09/203.0.113.10[-] Not vulnerable: https://example.com/logout?next=FUZZ[!] CRLF Injection: https://example.com/set?lang=%0d%0aSet-Cookie:orlz=1guidance
Use Oralyzer when you have URLs ready and need open-redirect findings, with an optional -crlf pass in the same run. Collect endpoints first. For async open-redirect-only work, reach for OpenRedireX; for dedicated CRLF scanning, use crlfuzz.
Async open-redirect fuzzer with custom payloads. Oralyzer adds CRLF testing and Wayback sourcing.
Focused CRLF injection scanner. Oralyzer folds a CRLF check into an open-redirect run.
XSS parameter scanner. Oralyzer covers redirect and CRLF classes instead.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A URL list feeds Oralyzer, which fuzzes each one for open redirect and CRLF flaws and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.