# CRLFuzz | A Fast Tool To Scan CRLF Vulnerability Written In Go

**URL:** <https://onehack.st/t/crlfuzz-a-fast-tool-to-scan-crlf-vulnerability-written-in-go/119251>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [September 24, 2020, 2:33pm UTC](https://onehack.st/t/crlfuzz-a-fast-tool-to-scan-crlf-vulnerability-written-in-go/119251 "2020-09-24T14:33:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [September 24, 2020, 2:33pm UTC](https://onehack.st/t/crlfuzz-a-fast-tool-to-scan-crlf-vulnerability-written-in-go/119251/1 "2020-09-24T14:33:13Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/b/3/b3d6033eeb32c803131b936a6e42037097991aaf.png)

A fast tool to scan CRLF vulnerability written in Go

**Installation**

**from Binary**

The installation is easy. You can download a prebuilt binary from [releases page](https://github.com/dwisiswant0/crlfuzz/releases), unpack and run! or with

```auto
$ curl -sSfL http://git.io/get-crlfuzz | sh -s -- -b /usr/local/bin

```

**from Source**

If you have go1.13+ compiler installed and configured:

```auto
$ GO111MODULE=on go get -v github.com/dwisiswant0/crlfuzz/cmd/crlfuzz

```

In order to update the tool, you can use `-u` flag with go get command.

**from GitHub**

```auto
$ git clone https://github.com/dwisiswant0/crlfuzz$ cd crlfuzz/cmd/crlfuzz$ go build .$ mv crlfuzz /usr/local/bin

```

**Usage**

**Basic Usage**

Simply, CRLFuzz can be run with:

```auto
$ crlfuzz -u "http://target"

```

**Flags**

```auto
$ crlfuzz -h

```

This will display help for the tool. Here are all the switches it supports.

| Flag | Description |
| --- | --- |
| -u, –url | Define single URL to fuzz |
| -l, –list | Fuzz URLs within file |
| -X, –method | Specify request method to use _(default: GET)_ |
| -o, –output | File to save results |
| -d, –data | Define request data |
| -H, –header | Pass custom header to target |
| -x, –proxy | Use specified proxy to fuzz |
| -c, –concurrent | Set the concurrency level _(default: 25)_ |
| -s, –silent | Silent mode |
| -v, –verbose | Verbose mode |
| -V, –version | Show current CRLFuzz version |
| -h, –help | Display its help |

**Target**

You can define a target in 3 ways:

**Single URL**

```auto
$ crlfuzz -u "http://target"

```

**URLs from list**

```auto
$ crlfuzz -l /path/to/urls.txt

```

**from Stdin**

In case you want to chained with other tools.

```auto
$ subfinder -d target -silent | httpx -silent | crlfuzz

```

**Method**

By default, CRLFuzz makes requests with `GET` method. If you want to change it, you can use the `-X` flag.

```auto
$ crlfuzz -u "http://target" -X "GET"

```

**Output**

You can also save fuzzing results to a file with `-o` flag.

```auto
$ crlfuzz -l /path/to/urls.txt -o /path/to/results.txt

```

**Data**

If you want to send a data request using POST, DELETE. PATCH or other methods, you just need to use `-d` flag.

```auto
$ crlfuzz -u "http://target" -X "POST" -d "data=body"

```

**Adding Headers**

May you want to use custom headers to add cookies or other header parts.

```auto
$ crlfuzz -u "http://target" -H "Cookie: ..." -H "User-Agent: ..."

```

**Using Proxy**

Using a proxy, proxy string can be specified with a `protocol://` prefix to specify alternative proxy protocols.

```auto
$ crlfuzz -u "http://target" -x http://127.0.0.1:8080

```

**Concurrency**

Concurrency is the number of fuzzing at the same time. Default value CRLFuzz provide is `25` , you can change it by using `-c` flag.

```auto
$ crlfuzz -l /path/to/urls.txt -c 50

```

**Silent**

If you activate this silent mode with the `-s` flag, you will only see vulnerable targets.

```auto
$ crlfuzz -l /path/to/urls.txt -s | tee vuln-urls.txt

```

**Verbose**

Unlike silent mode, it will display error details if there is an error with the `-v` flag.

```auto
$ crlfuzz -l /path/to/urls.txt -v

```

**Version**

To display the current version of CRLFuzz with the `-V` flag.

```auto
$ crlfuzz -V

```

**Library**

You can use CRLFuzz as a library.

```auto
package mainimport (	"fmt"	"github.com/dwisiswant0/crlfuzz/pkg/crlfuzz")func main() {	target := "http://target"	method := "GET"	// Generates a potentially CRLF vulnerable URLs	for _, url := range crlfuzz.GenerateURL(target) { // Scan against target vuln, err := crlfuzz.Scan(url, method, "", []string{}, "") if err != nil { panic(err) } if vuln { fmt.Printf("VULN! %sn", url) }	}}

```

**Help & Bugs**

If you are still confused or found a bug, please [open the issue](https://github.com/dwisiswant0/crlfuzz/issues). All bug reports are appreciated, some features have not been tested yet due to lack of free time.

**License**

**CRLFuzz** released under MIT. See `LICENSE` for more details.

**Version**

**Current version is 1.3.0** and still development.

## GitHub:

> **[GitHub - dwisiswant0/crlfuzz: A fast tool to scan CRLF vulnerability written in...](https://github.com/dwisiswant0/crlfuzz)**
>
> A fast tool to scan CRLF vulnerability written in Go