loading
Loading content
loading
Vulnerabilities
Python open-redirect and CRLF fuzzer for URLs and URL lists.
overview
Oralyzer fuzzes a target URL with redirect payloads and flags endpoints that forward the browser off-site. Point --url at one target or --list at a file of candidates collected upstream.
Enable -crlf to fold a CRLF header-injection pass into the same run. Supply --payload to control the redirect strings; --wayback pulls historical URLs from archive.org; --proxy routes traffic for inspection.
Place it after a crawler or archive miner that surfaces parameterized URLs. Prefer OpenRedireX for async open-redirect-only fuzzing; use crlfuzz when CRLF is the sole class under test.
use cases
Fuzz a target or a URL list with redirect payloads and flag the endpoints that forward the browser off-site to an attacker-controlled host.
Enable -crlf so the same run also checks for header-injection flaws, covering two URL-level classes in a single pass.
Turn on --wayback to source historical URLs from archive.org, reaching parameterized paths the live site no longer links.
Send requests through --proxy for inspection and supply a --payload file to test the exact redirect strings you care about.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Scan a single target URL. |
| url-list | FILE | --list | Scan multiple targets from a file. |
| payload | FILE | --payload | Use redirect payloads from a file. |
| crlf-test | BOOLEAN | -crlf | Also scan for CRLF injection. |
| wayback | BOOLEAN | --wayback | Fetch URLs from archive.org. |
| proxy | STRING | --proxy | Route requests through a proxy. |
Showing key inputs. oralyzer exposes 6 inputs in total.
example
# fuzz collected URLs for open redirect, with a CRLF passoralyzer --list urls.txt --payload payloads.txt -crlf[ Oralyzer ] [i] Payloads loaded: 58[i] Target: https://example.com/out?url=FUZZ [+] Open Redirect: https://example.com/out?url=//203.0.113.10[+] Open Redirect: https://example.com/out?url=/%09/203.0.113.10[-] Not vulnerable: https://example.com/logout?next=FUZZ[!] CRLF Injection: https://example.com/set?lang=%0d%0aSet-Cookie:orlz=1guidance
Use Oralyzer when you have URLs ready and need open-redirect findings, with an optional -crlf pass in the same run. Collect endpoints first. For async open-redirect-only work, reach for OpenRedireX; for dedicated CRLF scanning, use crlfuzz.
Async open-redirect fuzzer with custom payloads. Oralyzer adds CRLF testing and Wayback sourcing.
Focused CRLF injection scanner. Oralyzer folds a CRLF check into an open-redirect run.
XSS parameter scanner. Oralyzer covers redirect and CRLF classes instead.
faq
related
Automates OS command injection detection and exploitation.
Parameter mining and XSS testing with headless verification.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
A URL list feeds Oralyzer, which fuzzes each one for open redirect and CRLF flaws and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.