CRLF-Powered Desync Scanner

CRLF-Powered Desync Scanner detects HTTP request and response header injection vulnerabilities that arise when a front-end proxy forwards CRLF sequences into the request line or headers, allowing an attacker to inject their own headers, split requests, or desynchronize the connection. It is the research scanner behind the presentation "CRLF-Powered Desync Attacks: Beheading HTTP Streams".

Features

• Tests a broad set of request-line and header mutations: protocol-version confusion, duplicate and malformed Host headers, Transfer-Encoding/Content-Length desync, request smuggling, and tunnelling.
• Detects response header injection via a reflected canary header, flagging cases that react to smuggled length headers as potential response splitting.
• Confirms findings before reporting by repeating probes and running a follow-up, separating firm matches from lower-confidence diff-only results.
• Filters common WAF block pages and server signatures to cut false positives.
• Applies optional URL-encoding and a cache buster to slip probes past normalising intermediaries.

Usage

1. Right-click one or more requests in Burp and launch the scan from the context menu.
2. Enable the techniques you want and tune options such as follow-up confirmation, encoding, and cache busting.
3. Review reported issues, treating entries marked Dodgy as diff-based results needing manual confirmation.