What problem does it solve? Security testers need a disciplined, evidence-gated method to verify whether in-scope inputs can inject CRLF characters that alter HTTP response headers, cookies, Location redirects, or downstream message boundaries, without causing harm to shared caches or other users. ## Core Features & Use Cases - Trigger Signal Detection: Identifies CRLF-relevant inputs such as redirect Location parameters, download filenames, proxy rewrites, header reflection, and email header inputs. - Baseline-to-Oracle Methodology: Enforces a baseline, single-variable probe, post-baseline, oracle, and evidence workflow so findings are reproducible and false positives from WAF blocks or body reflections are excluded. - Safe Validation Boundaries: Restricts testing to harmless marker headers on owned low-traffic paths, and hands off response splitting or smuggling indicators to dedicated HTTP smuggling and cache poisoning routes. - Use Case: During an authorized web assessment, you notice a redirect parameter reflected into the Location header; use this Skill to determine whether encoded newline sequences produce a real injected header confirmed in Burp raw responses. ## Quick Start Ask the agent to run the CRLF injection route against an authorized target's redirect parameter and report whether any injected marker header appears in the raw response.
