crlf-injection

A focused attack playbook for CRLF injection, also known as HTTP response splitting, for use in authorized web security testing. The technique exploits places where user input is reflected into HTTP response headers such as Location redirects, Set-Cookie values, or log files without sanitizing carriage-return and line-feed characters (CR/LF, or %0D%0A). Injecting those characters can forge new headers, and a double CRLF can terminate the header block and inject a response body.

Detection starts with a simple probe: placing %0D%0AX-Injected:true in a redirect or URL parameter and checking whether the injected header appears in the response, then trying a double CRLF to inject body content. From there the guide lays out exploitation scenarios, including session fixation by injecting Set-Cookie, XSS by injecting a script into the response body, cache poisoning when a CDN or proxy caches the tampered response, redirect hijacking through an injected Location header, and log injection via User-Agent or Referer fields.

A filter-bypass table covers cases where %0D%0A is blocked, suggesting %0D or %0A alone, double URL-encoding as %250D%250A, Unicode/UTF-8 sequences, or moving the injection into a parameter name. Common vulnerable code patterns are shown across PHP header(), Python redirect(), Node.js setHeader(), and Java response.setHeader(), and a testing checklist ties the workflow together. The skill also notes a routing option to a companion technique for Java services where standard CRLF encodings are WAF-blocked, and it distinguishes itself from request smuggling, which targets message framing rather than response headers.