skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

crlf-injection

Detect CRLF injection vulnerabilities in HTTP response headers.

96|1|Updated Jun 4, 2026
Search Tags:#xss#security-testing#session-fixation#log-injection#cache-poisoning#crlf-injection#http-response-splitting
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill crlf-injection-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: crlf-injection
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/crlf-injection
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill crlf-injection-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the risk of unvalidated user input being reflected in HTTP response headers, which allows attackers to inject carriage-return/line-feed (CRLF) characters to split responses, inject malicious headers, or embed harmful content in the response body.

Core Features & Use Cases

  • Header Injection Detection: Probes for CRLF reflection in redirect URLs, Set-Cookie values, and custom headers to identify response splitting entry points.
  • Exploitation Playbook: Covers session fixation via injected Set-Cookie headers, XSS escalation via double CRLF body injection, cache poisoning, and log forgery attacks.
  • Filter Bypass Guidance: Includes techniques for evading common CRLF filters using double URL encoding, Unicode payloads, and partial line feed injection. A common use case is a security tester using this Skill to identify a vulnerable redirect parameter, then chaining the CRLF injection to session fixation to hijack privileged user accounts.

Quick Start

Use the crlf-injection skill to test if the redirect parameter on https://target.com/redirect is vulnerable to CRLF injection by sending a payload with encoded CRLF characters and checking for injected headers in the response.

Frequently Asked Questions about crlf-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is CRLF injection and how does HTTP response splitting work?▼

CRLF injection occurs when unvalidated user input reflected in HTTP response headers allows attackers to inject carriage-return/line-feed characters, splitting responses to inject malicious headers or harmful body content.

How do I test redirect URLs for CRLF injection vulnerabilities?▼

You can test redirect URLs for CRLF injection by sending payloads with encoded CRLF characters to the target parameter and checking the HTTP response for injected headers, Set-Cookie values, or split body content.

Can I bypass CRLF filters using double URL encoding or Unicode payloads?▼

Yes, common CRLF filters can be bypassed using techniques like double URL encoding, Unicode payloads, and partial line feed injection to successfully deliver the carriage-return/line-feed characters into the response headers.

How can CRLF injection be chained to session fixation or XSS attacks?▼

CRLF injection can be chained to session fixation by injecting Set-Cookie headers, escalated to XSS via double CRLF body injection, or used for cache poisoning and log forgery to hijack privileged user accounts.

Does this CRLF injection testing skill work with automated scanning tools?▼

Yes, this skill meets requirements for automated probing, filter bypass guidance, exploitation chain validation, and integration with HTTP testing and scanning tools for authorized vulnerability assessment.

When should I test for CRLF injection in custom HTTP headers?▼

You should test for CRLF injection in custom HTTP headers, redirect URLs, Set-Cookie values, and log-visible fields during authorized security testing to detect response splitting, cache poisoning, and log forgery vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
thejefflarsonthejefflarson
20

header-injection

Strip CRLF sequences from user-derived HTTP header values before assignment.

Community
Basic
Prohao42Prohao42
120

xss-cross-site-scripting

Deliver advanced XSS attack strategies for bypassing WAFs and CSPs.

Community
Advanced
ok-helloworldok-helloworld
241

crlf-injection

Detect CRLF injection vulnerabilities in HTTP response headers and bodies.

Community
Intermediate
TheBushidoCollectiveTheBushidoCollective
187

PHP Security Patterns

Detect and prevent security vulnerabilities in PHP web applications.

Official
Advanced