crlf-injection

1# SKILL: CRLF Injection — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
4 
5## 0. RELATED ROUTING
6 
7- [ghost-bits-cast-attack](../ghost-bits-cast-attack/SKILL.md) when the target is a **Java service** and `%0D%0A` / `\r\n` encodings are WAF-blocked — substituting `瘍` (U+760D, low byte `\r`) and `瘊` (U+760A, low byte `\n`) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes)
8 
9## 1. CORE CONCEPT
10 
11CRLF = `\r\n` (Carriage Return + Line Feed, `%0D%0A`). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
12 
13```
14Normal: Location: /page?url=USER_INPUT
15Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
16Result: Two headers — Location + injected Set-Cookie
17```
18 
19---
20 
21## 2. DETECTION
22 
23### Basic Probe
24 
25```text
26%0D%0ANew-Header:injected
27 
28# In URL parameter:
29https://target.com/redirect?url=%0D%0AX-Injected:true
30 
31# Check response headers for "X-Injected: true"
32```
33 
34### Double CRLF — Body Injection
35 
36Two consecutive CRLF sequences end headers and start body:
37 
38```text
39…