CRLF / header injection
A parameter that lands in a response header or a backend request header is a split gadget. Prove a new header you control, then ask what it becomes.
Tags: crlf, cache, xss, smuggling
Level: intermediate
Method
Find header sinks
Redirect Location, Set-Cookie, CORS, Link, Location built from next=, log shippers, backend Host. Reflections in the body are XSS, not CRLF.
crlfuzz -u {url} -sTools: Burp Suite, crlfuzz
Split with a marker
%0d%0aX-Vulns-CRLF: 1 and Unicode / nested encodings. The proof is your header on the response or on an outbound request you can see.
Tools: crlfuzz
Name the chain
Set-Cookie session fixation, Location open redirect, injected script via a header the HTML prints, cache poison if the header is unkeyed.
Tools: Burp Suite
Do not smuggle users
If the split desyncs HTTP/1, stop and switch to the smuggling playbook with a lab-safe probe. Do not append someone else's request.
Tools: smuggler
Field notes
- Some stacks strip bare CRLF but accept %E5%98%8A%E5%98%8D (UTF-8 overlong / encoded CRLF). Test encodings, then stop at the marker.
- Log injection without a header split is usually P5. Header split plus Set-Cookie is the report.