# CRLFsuite | CRLF injection scanner

**URL:** <https://onehack.st/t/crlfsuite-crlf-injection-scanner/287447>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [July 21, 2024, 8:19pm UTC](https://onehack.st/t/crlfsuite-crlf-injection-scanner/287447 "2024-07-21T20:19:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [July 21, 2024, 8:19pm UTC](https://onehack.st/t/crlfsuite-crlf-injection-scanner/287447/1 "2024-07-21T20:19:45Z")

</div>

[![](https://github.com/Nefcore/CRLFsuite/raw/main/static/CRLFsuite_logo2.0.png)](https://github.com/Nefcore/CRLFsuite/blob/main/static/CRLFsuite_logo2.0.png)

## CRLFsuite - CRLF injection scanner

[![made-with-python](https://camo.githubusercontent.com/0803dd070e693cce45f8ba4b9821fbd9cd3aad1b41345ace8d507785532fb818/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d616465253230776974682d507974686f6e2d3166343235662e737667)](https://www.python.org/) [![GitHub release](https://camo.githubusercontent.com/0521ba9dca0e8e5555817eb658678829e42278ac870364b2c39093acf0fcc0cb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f4e6566636f72652f43524c467375697465)](https://github.com/Nefcore/CRLFsuite/releases/) [![PyPI license](https://camo.githubusercontent.com/c4ea998feb8022a56d82ee4e56140fda462f83ecd527244713fa6e601d41c70a/68747470733a2f2f696d672e736869656c64732e696f2f707970692f6c2f616e7369636f6c6f72746167732e737667)](https://pypi.python.org/pypi/ansicolortags/) [![GitHub forks](https://camo.githubusercontent.com/cf50eebd53367d59f72cdb8fa0da4b3666d1b04080613e3c8c897bf98809b44e/68747470733a2f2f62616467656e2e6e65742f6769746875622f666f726b732f4e6566636f72652f43524c4673756974652f)](https://github.com/Nefcore/CRLFsuite/network/) [![GitHub contributors](https://camo.githubusercontent.com/b65dba33ecd275556cd6b86e1b380a2d2f5a28a05e326ea261d27e5e95d3363d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f636f6e7472696275746f72732f4e6566636f72652f43524c467375697465)](https://github.com/Nefcore/badges/graphs/contributors/)

[![](https://github.com/Nefcore/CRLFsuite/raw/main/static/crlfsuitev2.0.svg)](https://github.com/Nefcore/CRLFsuite/blob/main/static/crlfsuitev2.0.svg)

* * *

**The project is no more managed by developers.**

CRLFsuite is a powerful tool for `CRLF injection` detection and exploitation. Want to know how it works. [Here’s how](https://github.com/Nefcore/CRLFsuite/wiki/How-CRLFsuite-works%3F)

## Installation

You can install CRLFsuite using `pip` as given below:

```auto
pip3 install crlfsuite

```

or download this repository and run the following command:

```auto
sudo python3 setup.py install

```

## Features

- Single URL scanning
- Multiple URL scanning
- Stdin supported
- WAF detection
- Powerful payload generator
- CRLF Injection to XSS Chaining feature
- GET & POST method supported
- Concurrency
- Fast and efficient scanning with negligible false-positive

### Newly added in v2.5.1:

- Json & Text ouput supported
- Multiple headers supported
- Verbose output supported
- Scan can be resumed after CTRL^C is pressed
- Added heuristic (basic) scanner
- Compatibility with windows

### credits

- [prompt.py](https://github.com/Nefcore/CRLFsuite/blob/main/crlfsuite/core/prompt.py) is taken from [Arjun](https://github.com/s0md3v/Arjun/blob/master/arjun/core/prompt.py)
- WAF Detection methodology is taken from [XSStrike](https://github.com/s0md3v/XSStrike/blob/master/core/wafDetector.py)
- User-Agent list is taken from [ParamSpider](https://github.com/devanshbatham/ParamSpider/blob/master/core/requester.py)
- WAF signatures is taken from [XSStrike](https://github.com/s0md3v/XSStrike/blob/master/db/wafSignatures.json) and [wafw00f](https://github.com/EnableSecurity/wafw00f/tree/master/wafw00f/plugins)

## GitHub:

[https://github.com/Raghavd3v/CRLFsuite](https://github.com/Raghavd3v/CRLFsuite)