skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-for-crlf-injection

Tests web applications for CRLF injection enabling HTTP header injection and response splitting.

954|172|Updated Mar 13, 2026
Search Tags:#owasp#web-security#penetration-testing#crlf-injection#response-splitting#request-smuggling#http-header-injection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill testing-for-crlf-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-for-crlf-injection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/web-application-security/testing-for-crlf-injection
Command: npx skills add https://github.com/xalgord/xalgorix --skill testing-for-crlf-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications that reflect unsanitized user input into HTTP response headers allow attackers to inject carriage return and line feed sequences, leading to cookie planting, response splitting, XSS, cache poisoning, and request smuggling. This Skill provides a systematic methodology to detect, confirm, and escalate CRLF injection vulnerabilities that automated scanners frequently miss.

Core Features & Use Cases

  • Full Payload Matrix: Covers single CRLF header injection, double CRLF response splitting, Unicode newline bypasses (U+2028, U+2029, U+0085, overlong UTF-8), and open-redirect chaining variants.
  • Confirmation Workflow: Guides raw response inspection with curl and Burp Suite to distinguish real header injection from false negatives.
  • Escalation Paths: Documents advanced exploitation including PHP SoapClient header injection, response queue poisoning, memcache command injection, and pre-auth session tampering.
  • Use Case: During a penetration test, a redirect parameter like ?url= reflects into a Location header; this Skill walks you through planting a Set-Cookie header, splitting the response to inject XSS, and bypassing a WAF that strips literal %0d%0a using Unicode newline variants.

Quick Start

Ask the AI to test the target application's redirect and header-reflecting parameters for CRLF injection using the payload matrix and confirm results with raw curl responses.

Frequently Asked Questions about testing-for-crlf-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for CRLF injection in a web application?▼

Identify parameters reflected into response headers or redirects, then send payloads like %0d%0aSet-Cookie:%20test=1 and inspect the raw response with curl -i or Burp Suite. If the injected header appears in the header block, the parameter is vulnerable.

What is the difference between HTTP header injection and response splitting?▼

Header injection uses a single CRLF (%0d%0a) to add one header such as Set-Cookie or Location. Response splitting uses a double CRLF (%0d%0a%0d%0a) to terminate the header block entirely, letting the attacker inject a forged body or second response for XSS.

How do I bypass a WAF that blocks CRLF payloads?▼

Use Unicode newline variants that back-end servers normalize after the WAF strips literal \r\n. Payloads like %E5%98%8A%E5%98%8D, %E2%80%A8 (U+2028), %E2%80%A9 (U+2029), and %C2%85 (U+0085) often normalize to real line breaks on Java and other back-ends.

What tools can detect CRLF injection vulnerabilities?▼

CRLFsuite provides fast active scanning, crlfuzz offers wordlist-based fuzzing with Unicode payloads, and crlfix tests CRLF handling in Go HTTP clients. Burp Suite and curl -i remain essential for manually confirming injected headers in raw responses.

Can CRLF injection lead to request smuggling or SSRF?▼

Yes. When internal HTTP clients like PHP SoapClient, RestSharp, or Refit build requests from user input, injected CRLF sequences can add Host headers or smuggle entire secondary requests, enabling SSRF, response queue poisoning, and desynchronization attacks.

Why does my CRLF payload show in the body but not work?▼

If the payload appears only in the response body, the application encodes or rejects CR/LF in headers, so injection failed. Confirm hits only when the injected value appears as a real header line in the raw response, verified with curl -i rather than a browser.

Related Skills

Explore More Software Engineering Skills→
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
camilooscargbaptistacamilooscargbaptista
7

pentest

Assess security vulnerabilities in web applications, APIs, and infrastructure using PTES methodology.

Community
Advanced
langbyyilangbyyi
96

crlf-injection

Detect CRLF injection vulnerabilities in HTTP response headers.

Community
Intermediate
andrewthetechieandrewthetechie
2

jimmy-fuzz

Generate adversarial payloads for XSS, SQL injection, and path traversal attacks.

Community
Intermediate