crlf-injection

What problem does it solve?

CRLF injection playbooks help you identify and validate whether user-controlled input can break HTTP header boundaries to inject new headers, response bodies, or cached content.

Core Features & Use Cases

• Header injection & response splitting: Probe for %0D%0A-style payloads that create additional headers via redirect parameters, header-reflection points, or cookie construction.
• Double-CRLF body injection: Use header/body boundary termination to test for injected HTML/JS in contexts where the server reflects the payload.
• Attack chaining checks: Evaluate follow-on impact such as XSS escalation, session fixation via Set-Cookie, cache poisoning, redirect hijacking, and log injection.
• Filter bypass guidance: Apply targeted encoding strategies like double-encoding and LF-only variations to confirm robustness of input handling.

Quick Start

Provide the target URL and the parameter (or header reflection point) where input reaches a redirect, header, cookie, or log field, then ask for a step-by-step CRLF injection validation plan including bypass attempts.