domains / families / security / crlf-injection

crlf-injection

separate

CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.

When to use

• header injection
• response body injection via double CRLF
• XSS escalation
• cache poisoning
• encoding bypass
• session fixation via Set-Cookie
• log injection
• redirect hijack

When not to use

• Java service WAF-blocked CRLF using ghost-bits-cast-attack

Skill page

Source