CRLFuzz is a fast and efficient Go-based CLI tool designed to scan and detect CRLF injection vulnerabilities in web applications.
A fast tool to scan CRLF vulnerability written in Go
Security researchers and penetration testers use CRLFuzz to identify CRLF injection flaws that can lead to HTTP response splitting and header injection attacks. It is ideal for automating vulnerability scans on single or multiple URLs during web security assessments or as part of DevSecOps pipelines.
CRLFuzz requires Go 1.13+ for source installation and is best used with a good understanding of HTTP request methods and headers. When scanning multiple URLs, managing concurrency can optimize performance but may increase load on target servers. Use proxy support to route requests through intermediaries for anonymity or traffic inspection.
Download prebuilt binary from the releases page and run it
Run curl -sSfL https://git.io/crlfuzz | sh -s -- -b /usr/local/bin to install binary
Ensure Go 1.13+ is installed for source installation
Run GO111MODULE=on go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest to install from source
Clone the repository using git clone https://github.com/dwisiswant0/crlfuzz
Navigate to crlfuzz/cmd/crlfuzz directory
Build the binary with go build .
Move the built binary to /usr/local/bincrlfuzz -u "http://target"
Scan a single URL for CRLF vulnerabilities
crlfuzz -l /path/to/urls.txt
Scan multiple URLs listed in a file
subfinder -d target -silent | httpx -silent | crlfuzz
Pipe URLs from other tools into CRLFuzz for scanning
crlfuzz -u "http://target" -X "POST"
Specify HTTP method (e.g., POST) for requests
crlfuzz -l /path/to/urls.txt -o /path/to/results.txt
Save scan results to a specified output file
crlfuzz -u "http://target" -H "Authorization: Bearer token"
Add custom HTTP headers to requests
crlfuzz -u "http://target" -x http://127.0.0.1:8080
Use a proxy server for sending requests
crlfuzz -u "http://target" -c 50
Set concurrency level to 50 for faster scanning
crlfuzz -u "http://target" -s
Run in silent mode to suppress output
crlfuzz -u "http://target" -v
Run in verbose mode to display detailed output
crlfuzz -V
Display the current version of CRLFuzz
crlfuzz -h
Display help information and available flags