Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are good tools for finding CRLF injection vulnerabilities?

share|improve this question

closed as not constructive by AJ Henderson, Jeff Ferland Apr 12 '13 at 1:41

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What's CRLF? a linebreak? – CodesInChaos Apr 11 '13 at 20:49
As above @user1203028 has linked, the Acunetix WVS detects them as well. – NULLZ Apr 12 '13 at 0:09
@user1203028 - I see you have a few closed questions in a row. Have you had a good read of the faq and the about pages? They will help you structure your questions in a way that fits better here. – Rory Alsop Apr 12 '13 at 10:43
up vote 1 down vote accepted

CRLF injection can be used in IMAP/SMTP command injection and in HTTP Response Splitting. In both cases BURP is the tool of choice.

Wapiti is a FOSS vulnerability scanner that can detect http response splitting. The vast majority vulnerability scanners should be able to detect this attack.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.