sc-header-injection

To detect CRLF injection in HTTP response headers, scan your web application for instances where user-controlled input is unsafely placed into headers, enabling response splitting and header pollution. This Skill automates that detection process.

Yes, this CRLF header injection scanner works with web services built with Python, Node.js, Java, Go, PHP, and associated middleware where response headers are influenced by user input.

HTTP header injection occurs when user-controlled input is unsafely placed into HTTP response headers. Attackers can insert CRLF sequences to split responses or pollute headers, enabling cross-site scripting and session fixation.

To verify and fix CRLF injection risks, follow practical verification steps provided by the scanner. It guides safe header usage and secure coding practices to prevent response splitting across popular web frameworks.

The best way to prevent header pollution is to validate and guide safe header usage across common web frameworks. This Skill provides practical remediation steps and secure coding practices to ensure safe header handling.

User input causes CRLF vulnerabilities when unsafely placed into HTTP response headers without proper sanitization. This allows attackers to inject CRLF sequences, leading to response splitting and header injection attacks.