Understand, detect, and remediate carriage return and line feed vulnerabilities in web servers, application logs, and HTTP headers.
GET /index.html HTTP/1.1\r\n
Host: secure-target.com\r\n
X-Injected-Header: malicious\r\n\r\n
[!] Vulnerability detected: Header Splitting
CRLF refers to the control characters Carriage Return (`\r`, ASCII 13) and Line Feed (`\n`, ASCII 10). Together, they define a line break in HTTP protocols and standard text files. When user input is unvalidated and inserted directly into headers, attackers can inject these characters to manipulate responses.
Fundamental HTTP protocol mechanism used by web servers to separate headers from response bodies.
Occurs when malicious control characters trick servers into interpreting a single response as two separate HTTP streams.
Attackers inject fake log entries by embedding newline characters into input fields recorded by server logging utilities.
Comprehensive tools and methodologies to harden web infrastructure against protocol injection flaws.
Scan web applications for improper handling of user input inside HTTP response headers, redirect parameters, and cookie sets.
Implement robust sanitization routines to strip or encode `\r` and `\n` characters before data reaches response headers or logs.
A three-step process to secure your web server applications against protocol manipulation.
Scan parameters where user-supplied data reflects directly into HTTP response headers or server logs.
Strip all Carriage Return and Line Feed characters from input variables before constructing header responses.
Re-test application endpoints and set up continuous security monitoring for header anomalies.
Need help testing your web architecture for CRLF injection or HTTP response splitting vulnerabilities? Connect with our team.