crlf-injection

A fast tool to scan CRLF vulnerability written in Go

Python tool that probes websites for open redirection via headers, JavaScript, and meta-tag refresh, pulls candidate URLs from the Wayback Machine, and checks CRLF injection and DOM XSS.

The most powerful CRLF injection (HTTP Response Splitting) scanner.

CRLF and open redirect fuzzer

A CRLF ( Carriage Return Line Feed ) Injection attack occurs when a user manages to submit a CRLF into an application. This is most commonly done by modifying an HTTP parameter or URL.

CRLF Bug scanner for WebPentesters and Bugbounty Hunters

使用java编写的CRLF-Injection-burp被动扫描插件

📧 [Research] E-Mail Injection: Vulnerable applications

CRLF Detection based on @BlackFan 's work See link below

Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery vulnerability disclosed 2026-04-28. Defense-in-depth active mitigation shim, ModSec rule pack, remote probe, on-host IOC scanner, and per-tier RE snapshot collector. GPL v2.

CRLF Injection Payload List

CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON leads to auth bypass & instant root shell. Single/Mass exploitation, multi-threading, custom port/user, pipe mode, session keep-alive, colored output, retries, timeout support. Python & Bash versions. Critical CVSS 9.8.

This is a tool used by several security researchers to find Carriage Return Line Feed Injection Bug

HTTP header security scanner. Finds Host header injection, web cache poisoning, request smuggling and unkeyed-input gadgets, assesses HSTS/CSP/cookie posture, confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1 — and reports what it could not assess instead of counting it as a pass.

Want to keep your Web application from getting hacked? Here's how to get serious about secure apps. So let's do it! Open Friday, Aug 2016 - Presentation Notes.

CRLFISCANNER is a lightweight and powerful CLI tool designed for bug bounty hunters and penetration testers to automatically detect CRLF injection vulnerabilities through payload-based testing and HTTP header analysis.

CRLF injection scanner

This Bash script is a CRLF injection vulnerability scanner called REX. It checks for various CRLF injection vulnerabilities in a given URL by sending multiple payloads and analyzing the response

A web application to demonstrate log injection vulnerability and input sanitization methods to mitigate the vulnerability