Vulnerabilities
Fuzz collected URLs for open redirects and CRLF
Python open-redirect and CRLF fuzzer for URLs and URL lists.
overview
What oralyzer does
Oralyzer fuzzes a target URL with redirect payloads and flags endpoints that forward the browser off-site. Point --url at one target or --list at a file of candidates collected upstream.
Enable -crlf to fold a CRLF header-injection pass into the same run. Supply --payload to control the redirect strings; --wayback pulls historical URLs from archive.org; --proxy routes traffic for inspection.
Place it after a crawler or archive miner that surfaces parameterized URLs. Prefer OpenRedireX for async open-redirect-only fuzzing; use crlfuzz when CRLF is the sole class under test.
use cases
Where oralyzer fits
Scan URLs for open redirects
Fuzz a target or a URL list with redirect payloads and flag the endpoints that forward the browser off-site to an attacker-controlled host.
Test for CRLF injection too
Enable -crlf so the same run also checks for header-injection flaws, covering two URL-level classes in a single pass.
Pull targets from the Wayback Machine
Turn on --wayback to source historical URLs from archive.org, reaching parameterized paths the live site no longer links.
Route through a proxy with custom payloads
Send requests through --proxy for inspection and supply a --payload file to test the exact redirect strings you care about.
reference
oralyzer inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Scan a single target URL. |
| url-list | FILE | --list | Scan multiple targets from a file. |
| payload | FILE | --payload | Use redirect payloads from a file. |
| crlf-test | BOOLEAN | -crlf | Also scan for CRLF injection. |
| wayback | BOOLEAN | --wayback | Fetch URLs from archive.org. |
| proxy | STRING | --proxy | Route requests through a proxy. |
Showing key inputs. oralyzer exposes 6 inputs in total.
example
Run oralyzer
# fuzz collected URLs for open redirect, with a CRLF passoralyzer --list urls.txt --payload payloads.txt -crlf[ Oralyzer ] [i] Payloads loaded: 58[i] Target: https://example.com/out?url=FUZZ [+] Open Redirect: https://example.com/out?url=//203.0.113.10[+] Open Redirect: https://example.com/out?url=/%09/203.0.113.10[-] Not vulnerable: https://example.com/logout?next=FUZZ[!] CRLF Injection: https://example.com/set?lang=%0d%0aSet-Cookie:orlz=1guidance
Choosing oralyzer
Use Oralyzer when you have URLs ready and need open-redirect findings, with an optional -crlf pass in the same run. Collect endpoints first. For async open-redirect-only work, reach for OpenRedireX; for dedicated CRLF scanning, use crlfuzz.
openredirex
Async open-redirect fuzzer with custom payloads. Oralyzer adds CRLF testing and Wayback sourcing.
crlfuzz
Focused CRLF injection scanner. Oralyzer folds a CRLF check into an open-redirect run.
dalfox
XSS parameter scanner. Oralyzer covers redirect and CRLF classes instead.
workflows
Workflows using oralyzer
faq
oralyzer questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run oralyzer yourself
A URL list feeds Oralyzer, which fuzzes each one for open redirect and CRLF flaws and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.