crlf-injection

CRLF injection occurs when untrusted input injects carriage-return and line-feed characters into HTTP headers, splitting responses or forging downstream content by breaking header boundaries and injecting new headers or body content.

Test redirect parameters and cookie values by injecting CRLF sequences to alter Location behavior and trigger response splitting, validating whether untrusted input can forge new headers or break response bodies during authorized security testing.

Encoding bypasses and double CRLF body injection exploit partial newline variants and encoding tricks to evade naive filters, successfully splitting HTTP responses and forging downstream content when basic input validation is applied.

CRLF injection can chain into session fixation, reflected content injection, cache poisoning, and log forgery, manipulating header-processing paths to alter downstream content and session behavior in authorized testing scenarios.

Confirm exploitable header manipulation by validating injected headers and body breaks in log fields and redirect targets, checking whether untrusted input successfully splits responses or forges downstream content during authorized assessments.