Injectus - CRLF And Open Redirect Fuzzer

Simple python tool that goes through a list of URLs trying CRLF and open redirect payloads.

    ▪   ▐ ▄  ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ ·
    ██ •█▌▐█  ·██▀▄.▀·▐█ ▌▪•██  █▪██▌▐█ ▀.
    ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄
    ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█
    ▀▀▀▀  ██▪ ▀▀▀• ▀▀▀ ·▀▀▀  ▀▀▀  ▀▀▀  ▀▀▀▀
               ~ BOUNTYSTRIKE ~

usage: Injectus [-h] [-f FILE] [-u URL] [-r] [-w WORKERS] [-t TIMEOUT]
                [-d DELAY] [-c] [-op]

CRLF and open redirect fuzzer. Crafted by @dubs3c.

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  File containing URLs
  -u URL, --url URL     Single URL to test
  -r, --no-request      Only build attack list, do not perform any requests
  -w WORKERS, --workers WORKERS
                        Amount of asyncio workers, default is 10
  -t TIMEOUT, --timeout TIMEOUT
                        HTTP request timeout, default is 6 seconds
  -d DELAY, --delay DELAY
                        The delay between requests, default is 1 second
  -c, --crlf               Only perform crlf attacks
  -op, --openredirect   Only perform open redirect attacks

Needed a simple CRLF/open redirect scanner that I could include into my bug bounty pipeline at Didn't find any tools that satisfied my need, so I created Injectus. It's a little bit of an experiment, to see if it works better than other tools.

If we have the following URL:
For CRLF attacks, Injectus will inject every payload once into the value of one parameter, for every n parameters. For example, Injectus will create the following list with the URL above:   =value3   strike
As you can see, every CRLF payload is injected in the first parameter's value. Once the loop is done, Injectus will inject every payload into the second parameter, and so on. Once all parameters have been injected, the list is complete.
If there are no query parameters, Injectus will simply append each payload to the URL, like so:
When injecting open redirect payloads, Injectus will only inject a payload if there exists a query/path parameter containing a typical redirect keyword, e.g. url. Injecting into the following URL$$2fbountystrike.ioparam3=value3\x08ountystrike.ioparam3=value3
The URL contains the query parameter url, so Injectus will inject the payloads into that parameter.
An example when using path parameters. Original URL is$$\
As before, if no query parameters or path parameters are found, Injectus will simply append each payload to the URL:$$\\

pip3.7 install -r requirements.txt --user

Injectus - CRLF And Open Redirect Fuzzer Injectus - CRLF And Open Redirect Fuzzer Reviewed by Zion3R on 8:37 AM Rating: 5