CRLFuzz is a fast tool to scan CRLF vulnerability written in Go.
Installation
- From Binary
The installation is easy. You can download a prebuilt binary from releases page, unpack and run! or with
curl -sSfL https://git.io/crlfuzz | sh -s — -b /usr/local/bin
- From Source
If you have go1.13+ compiler installed and configured:
GO111MODULE=on go get -v github.com/dwisiswant0/crlfuzz/cmd/crlfuzz
In order to update the tool, you can use -u flag with go get command.
- From GitHub
git clone https://github.com/dwisiswant0/crlfuzz
cd crlfuzz/cmd/crlfuzz
go build .
mv crlfuzz /usr/local/bin
Usage
- Basic Usage
- Simply, CRLFuzz can be run with:
crlfuzz -u “http://target”
- Flags
crlfuzz -h
This will display help for the tool. Here are all the switches it supports.
| Flag | Description |
|---|---|
| -u, –url | Define single URL to fuzz |
| -l, –list | Fuzz URLs within file |
| -X, –method | Specify request method to use (default: GET) |
| -o, –output | File to save results |
| -d, –data | Define request data |
| -H, –header | Pass custom header to target |
| -x, –proxy | Use specified proxy to fuzz |
| -c, –concurrent | Set the concurrency level (default: 25) |
| -s, –silent | Silent mode |
| -v, –verbose | Verbose mode |
| -V, –version | Show current CRLFuzz version |
| -h, –help | Display its help |
- Target
You can define a target in 3 ways:
- Single URL
crlfuzz -u “http://target”
- URLs from list
crlfuzz -l /path/to/urls.txt
- From Stdin
In case you want to chained with other tools.
subfinder -d target -silent | httpx -silent | crlfuzz
- Method
By default, CRLFuzz makes requests with GET method. If you want to change it, you can use the -X flag.
crlfuzz -u “http://target” -X “GET”
- Output
You can also save fuzzing results to a file with -o flag.
crlfuzz -l /path/to/urls.txt -o /path/to/results.txt
- Data
If you want to send a data request using POST, DELETE. PATCH or other methods, you just need to use -d flag.
crlfuzz -u “http://target” -X “POST” -d “data=body”
- Adding Headers
May you want to use custom headers to add cookies or other header parts.
crlfuzz -u “http://target” -H “Cookie: …” -H “User-Agent: …”
- Using Proxy
Using a proxy, proxy string can be specified with a protocol:// prefix to specify alternative proxy protocols.
crlfuzz -u “http://target” -x http://127.0.0.1:8080
Concurrency
Concurrency is the number of fuzzing at the same time. Default value CRLFuzz provide is 25, you can change it by using -c flag.
crlfuzz -l /path/to/urls.txt -c 50
- Silent
If you activate this silent mode with the -s flag, you will only see vulnerable targets.
crlfuzz -l /path/to/urls.txt -s | tee vuln-urls.txt
- Verbose
Unlike silent mode, it will display error details if there is an error with the -v flag.
crlfuzz -l /path/to/urls.txt -v
- Version
To display the current version of CRLFuzz with the -V flag.
crlfuzz -V
- Library
You can use CRLFuzz as a library.
package main
import (
“fmt”
“github.com/dwisiswant0/crlfuzz/pkg/crlfuzz”
)
func main() {
target := “http://target”
method := “GET”
// Generates a potentially CRLF vulnerable URLs
for _, url := range crlfuzz.GenerateURL(target) {
// Scan against target
vuln, err := crlfuzz.Scan(url, method, “”, []string{}, “”)
if err != nil {
panic(err)
}
if vuln {
fmt.Printf(“VULN! %s\n”, url)
}
}
}
