Agent skill · security · yaklang
crlf-injection
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
Why this skill is useful
Adds detailed exploitation scripts and techniques for CRLF injection that are not commonly known or documented.
What it needs
About 3k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: CRLF Injection — Expert Attack Playbook AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks. 0. RELATED ROUTING ghost-bits-cast-attack when the target is a Java service and %0D%0A / \r\n encodings are WAF-blocked — substituting 瘍 (U+760D, low byte \r) and 瘊 (U+760A, low byte \n) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes) 1. CORE CONCEPT CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body. --- 2. DETECTION Basic Probe Double CRLF — Body Injection Two consecutive CRLF sequences end headers and start body: --- 3. EXPLOITATION SCENARIOS Session Fixation via Set-Cookie XSS via Response Body Cache Poisoning If the response is cached by a CDN or proxy, injected headers/body are served to all users: Log Injection CRLF in log-visible fields (User-Agent, Referer) can forge log entries: --- 4. FILTER BYPASS Filter Bypass --- --- Blocks %0D%0A Try %0D alone, %0A alone, or %E5%98%8A%E5%98%8D (Unicode) URL decodes once Double-encode: %250D%250A Strips \r\n literally Use URL-encoded form Blocks in value only Inject in parameter name --- 5. REAL-WORLD EXPLOITATION CHAINS CRLF + Session Fixation CRLF → XSS via Double CRLF Body Injection CRLF in 302 Location → Redirect Hijack --- 6. COMMON VULNERABLE PATTERNS --- 7. TESTING CHECKLIST
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/crlf-injection