Vulnerability field guide
CRLF Injection
A carriage return and a line feed are all it takes to inject headers, forge cookies and poison caches. Here is how CRLF injection leads to HTTP response splitting, and how to shut it down.
1 articles5 min totalOverview to advanced techniques
Start here
%0d%0aSet-Cookie: session=1Step 01 · Start with the overview
CRLF Injection5 min read
CRLF Injection: How Two Invisible Characters Split an HTTP Response
A carriage return and a line feed are all it takes to inject headers, forge cookies and poison caches. Here is how CRLF injection leads to HTTP response splitting, and how to shut it down.
Read the overview