Oralyzer

A Python tool for Open Redirect vulnerabilities. It fuzzes the target URL with redirect payloads and reports which ones the server actually follows to an external host.

Features

• Open Redirect Detection: Header, JavaScript, and meta-tag redirects
• CRLF Injection Scanning: HTTP response splitting vulnerabilities
• URL Discovery: Harvest candidate URLs from Common Crawl's index
• JSON Export: Export findings for further analysis
• Proxy Support: Route requests through HTTP proxies

Installation

With pipx (recommended)

pipx installs CLI tools into isolated environments, so oralyzer works system-wide without touching your system Python — and you sidestep the externally-managed-environment error on Debian/Ubuntu (PEP 668).

# Install pipx if you don't have it
sudo apt install pipx
pipx ensurepath

# Install Oralyzer
pipx install oralyzer

With pip in a virtual environment

Prefer plain pip? Create a venv first:

python3 -m venv .venv
source .venv/bin/activate
pip install oralyzer

From source

git clone https://github.com/r0075h3ll/Oralyzer.git
cd Oralyzer
pipx install .
# or, inside a venv:
pip install .

Or skip installing altogether and run it directly:

python3 -m venv .venv
source .venv/bin/activate
pip install .
python -m oralyzer -u https://example.com/

Usage

# Single target
oralyzer -u https://example.com/login

# Multiple targets from file
oralyzer -l targets.txt

# Export findings to JSON
oralyzer -u https://example.com/login -o results.json

# CRLF injection scan
oralyzer -u https://example.com/ -crlf

# Harvest URLs from Common Crawl
oralyzer -u example.com --discover

# Use proxy
oralyzer -u https://example.com/ --proxy http://127.0.0.1:8080

# Verbose logging
oralyzer -u https://example.com/ -v

# Concurrent scanning with custom workers
oralyzer -l targets.txt --workers 10 -o results.json

Command-line Options

Option	Description
-u, --url URL	Scan a single target
-l, --list PATH	Scan multiple targets from a file
-p, --payload PATH	Use custom payloads file
-o, --output PATH	Export findings to JSON
-crlf	Scan for CRLF injection
--discover	Harvest candidate URLs from Common Crawl
--proxy URL	Route requests through proxy
--timeout SECONDS	Request timeout (default: 10)
--workers N	Concurrent workers (default: 5)
--limit N	Stop after N findings
--filter TYPE	Only report: header, javascript, meta, crlf
-q, --quiet	Only show findings
--no-color	Disable colored output
-v, --verbose	Enable verbose logging

Output Format

Findings are exported as JSON:

[
  {
    "type": "header",
    "request_url": "https://example.com/login?next=//evil.com",
    "payload": "//evil.com",
    "status_code": 302,
    "destination": "https://evil.com"
  },
  {
    "type": "javascript",
    "request_url": "https://example.com/page",
    "payload": "//evil.com",
    "status_code": 200,
    "sources": ["location.href", "document.URL"]
  }
]