CRLFuzz Documentation

Save Results to File

Use the -o flag to save findings to a specific file:

crlfuzz -l /path/to/urls.txt -o /path/to/results.txt

Silent vs Verbose Mode

• Silent (-s): Only displays vulnerable targets. Useful for piping to other tools.

  crlfuzz -l /path/to/urls.txt -s | tee vuln-urls.txt

• Verbose (-v): Displays detailed error information if errors occur.

Concurrency

Adjust the number of simultaneous fuzzing tasks (default is 25) using -c:

crlfuzz -l /path/to/urls.txt -c 50

CRLFuzz is a fast tool written in Go for scanning CRLF vulnerabilities. You can run it against a single URL, a list of URLs, or via stdin.

Basic Usage

crlfuzz -u "http://target"

Target Options

• Single URL: Use -u or --url.
• URLs from list: Use -l or --list with a file path.
• From Stdin: Pipe URLs from other tools directly into crlfuzz.

subfinder -d target -silent | httpx -silent | crlfuzz

You can install CRLFuzz using several methods:

From Binary

Download a prebuilt binary from the releases page or use the following curl command:

curl -sSfL https://git.io/crlfuzz | sh -s -- -b /usr/local/bin

From Source (Go install)

If you have go1.13+ installed:

GO111MODULE=on go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest

To update, use the -u flag with the go get command.

From GitHub

Clone the repository and build manually:

git clone https://github.com/dwisiswant0/crlfuzz
cd crlfuzz/cmd/crlfuzz
go build .
mv crlfuzz /usr/local/bin

You can customize the HTTP requests sent by CRLFuzz using several flags:

HTTP Method and Data

Change the method (e.g., POST) and provide request body data:

crlfuzz -u "http://target" -X "POST" -d "data=body"

Custom Headers

Add custom headers like cookies or User-Agents:

crlfuzz -u "http://target" -H "Cookie: ..." -H "User-Agent: ..."

Proxy Configuration

Route requests through a proxy using the protocol:// prefix:

crlfuzz -u "http://target" -x http://127.0.0.1:8080

You can integrate CRLFuzz into your Go applications by importing github.com/dwisiswant0/crlfuzz/pkg/crlfuzz.

Use crlfuzz.GenerateURL(target) to generate potentially vulnerable URLs and crlfuzz.Scan(url, method, data, headers, proxy) to perform the actual scan.

Note: headers expects a slice of strings ([]string{}).

package main

import (
	"fmt"

	"github.com/dwisiswant0/crlfuzz/pkg/crlfuzz"
)

func main() {
	target := "http://target"
	method := "GET"

	// Generates a potentially CRLF vulnerable URLs
	for _, url := range crlfuzz.GenerateURL(target) {
		// Scan against target
		vuln, err := crlfuzz.Scan(url, method, "", []string{}, "")
		if err != nil {
			panic(err)
		}

		if vuln {
			fmt.Printf("VULN! %s\n", url)
		}
	}
}

The Client function in the request package returns a pre-configured *http.Client optimized for vulnerability scanning.

Key characteristics of the returned client:

• TLS Configuration: It is configured with InsecureSkipVerify: true, meaning it will skip certificate verification (useful for scanning targets with self-signed certificates).
• Timeouts: It has a global request timeout of 30 seconds and a dial timeout of 30 seconds.
• Redirect Handling: It is configured to return the last response instead of following redirects (http.ErrUseLastResponse), which is critical for detecting CRLF injection vulnerabilities that occur during redirect headers.
• Proxy Support: If a proxy URL string is provided, the client will use it for all requests.
• Connection Pooling: It maintains up to 30 idle connections with a 1-second idle timeout.