Fast CRLF injection scanner written in Go that detects HTTP response splitting and header injection vulnerabilities.
crlfuzz {flag-verbose} {flag-threads} {flag-timeout} {flag-concurrency} {flag-output} {target} 📎 flag-verbose 📎 flag-threads 📎 flag-timeout 📎 flag-concurrency 📎 flag-output 📎 target crlfuzz {flag-verbose} {flag-threads} {flag-timeout} {flag-concurrency} {flag-output} {target}Sandbox: execFile · Timeout: 120s
web.crlf.detect web.injection.header web.response.split | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
target | string | Yes | - | Target URL or host:port | - |
flag-verbose | boolean | No | - | Verbose output | -v, --verbose |
flag-threads | integer | No | - | Number of concurrent threads | -t, --threads |
flag-timeout | integer | No | - | Request timeout in seconds | --timeout |
flag-output | string | No | - | Output file for results | -o, --output |
flag-concurrency | integer | No | - | Concurrent scan level | -c, --concurrency |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
web.crlf.report | CRLF injection scan results | text/plain | - | verified |
Inputs
web.target.url Target URL
Outputs
web.crlf.report Scan results with vulnerable endpoints
network_traffic Produces
web.crlf.reportConsumes
web.target.url| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | low |
| Disk I/O | low |
Basic CRLF scan
crlfuzz -u https://example.comVerbose scan with threads
crlfuzz -u https://example.com -v -t 50Save results to file
crlfuzz -u https://example.com -o results.txtCRLFuzz is a fast Go-based tool for scanning CRLF (Carriage Return Line Feed) injection vulnerabilities. It tests for HTTP response splitting and header injection by injecting CRLF sequences into request parameters and headers.
# Basic scan
crlfuzz -u https://example.com
# Verbose with concurrent threads
crlfuzz -u https://example.com -v -t 100
# Save to file
crlfuzz -u https://example.com -o vulnerable.txt