CRLF Desyncs

This is a repository containing useful tools and resources for detecting and exploiting CRLF-based Desyncs, presented at BlackHat USA 2026 and DEFCON 34.

Contents

• cdn-origin/ -> contains aggregated origin-to-edge headers useful for fuzzing a CRLF injection on a response.
• nuclei-templates/ -> collection of nuclei templates which can help detecting CRLF injections at scale.
• cookier.py -> util script to easily format a CRLF-based cookie tossing payload.
• header-name-wordlist.txt -> custom large header wordlist for fuzzing weird behavior when dealing with a CRLF injection.
• iframe.html -> attacker page for exploiting browser powered tunneling in iframes (useful against weak SameSite cookie settings).
• popup.html -> attacker page for exploiting browser powered tunneling using refreshing popup windows.

Contributions