CRLFuzz

A fast tool to scan CRLF vulnerability written in Go

Changelog v1.4.1

0a8bcc8 Merge pull request #13 from dwisiswant0/dependabot/github_actions/peter-evans/create-pull-request-v3.5.1
391db38 ⬆️ Bump peter-evans/create-pull-request from v3.5.0 to v3.5.1
ae45136 Merge pull request #12 from dwisiswant0/dependabot/github_actions/peter-evans/create-pull-request-v3.5.0
b65aef5 ⬆️ Bump peter-evans/create-pull-request from v2 to v3.5.0
2301c3e Merge pull request #11 from dwisiswant0/dependabot/github_actions/golangci/golangci-lint-action-v2.3.0
4842319 ⬆️ Bump golangci/golangci-lint-action from v2.2.1 to v2.3.0
fdec043 Merge pull request #9 from dwisiswant0/dependabot/github_actions/golangci/golangci-lint-action-v2.2.1
e8efdde ⬆️ Bump golangci/golangci-lint-action from v2.2.0 to v2.2.1
62d7bf7 Merge pull request #8 from dwisiswant0/lgtm
83a5587 🚨 disabled-certificate-check
d3faa1f 🚨 LGTM alerts
996d71f ✏️ Update installer script
67f7449 Merge pull request #6 from dwisiswant0/development
8f8275f Merge pull request #5 from dwisiswant0/development

Usage

Basic Usage

Simply, CRLFuzz can be run with:

Flags

This will display help for the tool. Here are all the switches it supports.

Target

You can define a target in 3 ways:

Single URL

URLs from list

from Stdin

In case you want to chain with other tools.

Method

By default, CRLFuzz makes requests with the GET method. If you want to change it, you can use the -X flag.

Data

If you want to send a data request using POST, DELETE. PATCH or other methods, you just need to use -d flag.

Adding Headers

May you want to use custom headers to add cookies or other header parts.

Using Proxy

Using a proxy, a proxy string can be specified with a protocol:// prefix to specify alternative proxy protocols.

Concurrency

Concurrency is the number of fuzzing at the same time. The default value CRLFuzz provides is 20, you can change it by using -c flag.

Silent

If you activate this silent mode with the -s flag, you will only see vulnerable targets.

Verbose

Unlike silent mode, it will display error details if there is an error with the -v flag.

Version

To display the current version of CRLFuzz with the -V flag.

▶ crlfuzz -V

Library

You can use CRLFuzz as a library.

package main



import (

	"fmt"



	"dw1.io/crlfuzz/pkg/crlfuzz"

)



func main() {

	target := "http://target"

	method := "GET"



	// Generates a potentially CRLF vulnerable URLs

	for _, url := range crlfuzz.GenerateURL(target) {

		// Scan against target

		vuln, err := crlfuzz.Scan(url, method, "", []string{}, "")

		if err != nil {

			panic(err)

		}



		if vuln {

			fmt.Printf("VULN! %s\n", url)

		}

	}

}

Download

Copyright (c) 2020 dwisiswant0