crlfuzz

Overview

crlfuzz scans for CRLF (Carriage Return Line Feed) injection vulnerabilities in web applications. CRLF injection can lead to HTTP response splitting, header injection, XSS, and session fixation. The tool is fast and can scan multiple targets in parallel.

Basic Usage

Scan a single URL

crlfuzz -u "https://example.com/path?param=value"

Method (default: GET)

crlfuzz -u "https://example.com/" -X POST

From file

crlfuzz -l urls.txt

Silent output (only vulnerable)

crlfuzz -u "https://example.com/" -s

Verbose output

crlfuzz -u "https://example.com/" -v

Performance

Set concurrency

crlfuzz -l urls.txt -c 25

Set timeout (seconds)

crlfuzz -u "https://example.com/" -t 10

Skip SSL verification

crlfuzz -u "https://example.com/" -k

What CRLF Injection Enables

Injection payload: %0d%0a (CR+LF)
                   %0d (CR)
                   %0a (LF)
                   %23%0d%0a (# + CR+LF)

Impact:
  - HTTP response splitting
  - Set-Cookie header injection (session fixation)
  - XSS via injected Content-Type or X-XSS-Protection headers
  - Cache poisoning
  - Log injection

Manual Testing

Test if a parameter is injectable

curl -v "https://example.com/redirect?url=https://evil.com%0d%0aSet-Cookie:%20session=hijacked"

Check response headers for injection

curl -sI "https://example.com/?param=test%0d%0aX-Injected:%20true" | grep -i "injected"

# Common injection points
# - redirect parameters: ?url=, ?next=, ?return=
# - tracking: ?ref=, ?source=, ?from=
# - search: ?q=, ?search=, ?query=

Integration

Combine with subfinder + httpx

subfinder -d target.com -silent | \
  httpx -silent | \
  crlfuzz -l - -s

With waybackurls for historical URLs

waybackurls target.com | \
  grep "=" | \
  crlfuzz -l - -s

Tips

• Focus on redirect parameters (?url=, ?next=, ?return=) — highest yield
• CRLF in headers (not just body) is where impact lies
• Combine with gf redirect to pre-filter URLs to likely redirect params
• Verify manually with curl — automated tools can have false positives

crlfuzz [flags]

-u URL          Target URL
-l FILE         File with list of URLs
-X METHOD       HTTP method (default: GET)
-c N            Concurrency (default: 25)
-t N            Timeout in seconds (default: 10)
-s              Silent mode (only print vulnerable)
-v              Verbose mode
-k              Skip SSL verification
-H HEADER       Custom header
-x PROXY        Proxy URL

Vue d’ensemble

crlfuzz recherche les vulnérabilités d’injection CRLF (Carriage Return Line Feed) dans les applications web. L’injection CRLF peut mener à du HTTP response splitting, de l’injection d’en-têtes, du XSS et de la fixation de session. L’outil est rapide et peut scanner plusieurs cibles en parallèle.

Utilisation de base

# Scanner une seule URL
crlfuzz -u "https://example.com/path?param=value"

# Méthode (défaut : GET)
crlfuzz -u "https://example.com/" -X POST

# Depuis un fichier
crlfuzz -l urls.txt

# Sortie silencieuse (seulement les vulnérables)
crlfuzz -u "https://example.com/" -s

# Sortie verbeuse
crlfuzz -u "https://example.com/" -v

Performance

# Définir la concurrence
crlfuzz -l urls.txt -c 25

# Définir le timeout (secondes)
crlfuzz -u "https://example.com/" -t 10

# Ignorer la vérification SSL
crlfuzz -u "https://example.com/" -k

Ce que permet l’injection CRLF

Payload d'injection : %0d%0a (CR+LF)
                      %0d (CR)
                      %0a (LF)
                      %23%0d%0a (# + CR+LF)

Impact :
  - HTTP response splitting
  - Injection d'en-tête Set-Cookie (fixation de session)
  - XSS via injection d'en-têtes Content-Type ou X-XSS-Protection
  - Cache poisoning
  - Injection dans les logs

Test manuel

# Tester si un paramètre est injectable
curl -v "https://example.com/redirect?url=https://evil.com%0d%0aSet-Cookie:%20session=hijacked"

# Vérifier les en-têtes de réponse pour l'injection
curl -sI "https://example.com/?param=test%0d%0aX-Injected:%20true" | grep -i "injected"

# Points d'injection courants
# - paramètres de redirection : ?url=, ?next=, ?return=
# - tracking : ?ref=, ?source=, ?from=
# - recherche : ?q=, ?search=, ?query=

Intégration

# Combiner avec subfinder + httpx
subfinder -d target.com -silent | \
  httpx -silent | \
  crlfuzz -l - -s

# Avec waybackurls pour les URLs historiques
waybackurls target.com | \
  grep "=" | \
  crlfuzz -l - -s

Conseils

• Concentrez-vous sur les paramètres de redirection (?url=, ?next=, ?return=) : le meilleur rendement
• L’impact du CRLF réside dans les en-têtes (pas seulement le corps)
• Combinez avec gf redirect pour pré-filtrer les URLs vers les paramètres de redirection probables
• Vérifiez manuellement avec curl : les outils automatisés peuvent avoir des faux positifs

crlfuzz [flags]

-u URL          Target URL
-l FILE         File with list of URLs
-X METHOD       HTTP method (default: GET)
-c N            Concurrency (default: 25)
-t N            Timeout in seconds (default: 10)
-s              Silent mode (only print vulnerable)
-v              Verbose mode
-k              Skip SSL verification
-H HEADER       Custom header
-x PROXY        Proxy URL