CRLFuzz is a fast, MIT-licensed command-line tool written in Go that scans web targets for CRLF injection vulnerabilities, aimed at penetration testers, bug bounty hunters, and security engineers who need to check either a single URL or a long list of them quickly.

What it is

CRLFuzz is a focused vulnerability scanner distributed as a Go program whose module path is github.com/dwisiswant0/crlfuzz. It lives in the Go command-line security tooling ecosystem: source builds require a go1.13+ compiler and can be produced with go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest, prebuilt binaries are published on the project's releases page, and the package is also documented on godoc for use as a library. The tool does one thing, and the topic list reflects that narrow scope — CRLF injection, vulnerability scanning, and Golang. It accepts a target as a single URL through -u/--url, as a file of URLs through -l/--list, or from standard input when piped from another tool, and it reports what it finds either to the terminal or to a file with -o/--output.

The concrete problem it solves is the cost of testing CRLF injection by hand. Checking whether an application mishandles carriage-return and line-feed sequences normally means crafting individual requests per endpoint, per parameter, per method, and per header, then reading responses to judge whether the injected sequence was reflected — work that is slow, repetitive, and easy to get wrong across a large target set. CRLFuzz replaces that manual, one-off request crafting with a single invocation that issues the requests concurrently and surfaces the results, and because it reads from stdin it fits directly behind reconnaissance tooling in an existing pipeline.

Key capabilities

• Fuzzes a single target with -u/--url or a list of URLs from a file with -l/--list, and accepts targets piped on stdin for chaining.
• Controls the HTTP request method with -X/--method, which defaults to GET.
• Sends request bodies with -d/--data, so methods such as POST, DELETE, and PATCH can be exercised rather than only GET.
• Adds arbitrary request headers with -H/--header, including values such as Cookie: ... and User-Agent: ....
• Routes traffic through a proxy with -x/--proxy, accepting a protocol:// prefix to select the proxy protocol.
• Configures concurrency with -c/--concurrent, which defaults to 25 simultaneous fuzzing operations.
• Writes results to a file with -o/--output, and offers silent (-s/--silent) and verbose (-v/--verbose) output modes plus -V/--version and -h/--help.

Who uses it and how

• Penetration testers and bug bounty hunters checking a specific application endpoint for CRLF injection before moving on to other vulnerability classes.
• Reconnaissance workflows that enumerate subdomains and probe live hosts, then feed the resulting URLs straight into the scanner, as in subfinder -d target -silent | httpx -silent | crlfuzz.
• Bulk assessment of large target inventories, where URLs are stored in a text file and passed with -l, with the concurrency level raised above the default of 25 for faster runs.
• Authenticated or session-specific testing, where cookies and other custom header values are supplied through repeated -H flags.
• Traffic inspection setups, where requests are sent through a local proxy at an address such as http://127.0.0.1:8080 with -x.

Getting started

The quickest route is the prebuilt binary from the releases page, or the installer script curl -sSfL https://git.io/crlfuzz | sh -s -- -b /usr/local/bin. With go1.13 or newer configured, install it with GO111MODULE=on go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest, then run crlfuzz -u "http://target".

How it compares

The facts provided name no competing products that CRLFuzz replaces, and no other CRLF injection scanner appears alongside it, so it stands alone in this registry as a single-purpose tool for that vulnerability class. The only other tools named in its documentation, subfinder and httpx, are not alternatives: they perform subdomain enumeration and HTTP probing upstream, and CRLFuzz is designed to consume their output through stdin as the final stage of a pipeline.

When to use it — and when not to

There is very little to operate: the tool is a single Go binary with no database, storage layer, or mail service to run, so self-hosting means downloading or building the binary and keeping it updated rather than maintaining infrastructure. Teams looking for broad application security coverage, a graphical interface, or a scanner that checks vulnerability classes beyond CRLF injection should look elsewhere, because this project addresses exactly one issue and exposes its behaviour only through command-line flags. It also documents no container image or hosted option, so anyone who prefers to deploy scanners as containers or consume them as a service will need to build that packaging themselves.

▶ curl -sSfL https://git.io/crlfuzz | sh -s -- -b /usr/local/bin

▶ GO111MODULE=on go install github.com/dwisiswant0/crlfuzz/cmd/crlfuzz@latest

▶ git clone https://github.com/dwisiswant0/crlfuzz
▶ cd crlfuzz/cmd/crlfuzz
▶ go build .
▶ mv crlfuzz /usr/local/bin

▶ crlfuzz -u "http://target"

▶ crlfuzz -h

▶ crlfuzz -u "http://target"

▶ crlfuzz -l /path/to/urls.txt

▶ subfinder -d target -silent | httpx -silent | crlfuzz

▶ crlfuzz -u "http://target" -X "GET"

▶ crlfuzz -l /path/to/urls.txt -o /path/to/results.txt

▶ crlfuzz -u "http://target" -X "POST" -d "data=body"

▶ crlfuzz -u "http://target" -H "Cookie: ..." -H "User-Agent: ..."

▶ crlfuzz -u "http://target" -x http://127.0.0.1:8080

▶ crlfuzz -l /path/to/urls.txt -c 50

▶ crlfuzz -l /path/to/urls.txt -s | tee vuln-urls.txt

▶ crlfuzz -l /path/to/urls.txt -v

▶ crlfuzz -V

package main

import (
	"fmt"

	"github.com/dwisiswant0/crlfuzz/pkg/crlfuzz"
)

func main() {
	target := "http://target"
	method := "GET"

	// Generates a potentially CRLF vulnerable URLs
	for _, url := range crlfuzz.GenerateURL(target) {
		// Scan against target
		vuln, err := crlfuzz.Scan(url, method, "", []string{}, "")
		if err != nil {
			panic(err)
		}

		if vuln {
			fmt.Printf("VULN! %s\n", url)
		}
	}
}