CRLF Injection labs
CRLF Injection / HTTP Response Splitting
What is CRLF Injection?
CRLF Injection injects carriage-return and line-feed characters (%0d%0a) into input the server reflects inside HTTP headers. It lets you add arbitrary headers, split the response (HTTP response splitting), inject Set-Cookie or redirects, forge logs and escalate to XSS.
Why practice CRLF Injection?
It's a classic bug that still shows up in redirects, language headers and values reflected in headers, especially where there are proxies or old frameworks. On its own it can give session fixation or XSS, and chained with the cache it escalates to massive impact. A great bug for hunters who want to master the HTTP protocol.
What will you learn with the CRLF Injection labs?
You'll learn to locate input reflected in headers (Location, Set-Cookie, language), inject %0d%0a to create new headers, split the response with a double CRLF to control the body, fix session cookies (session fixation) and chain the injection to a reflected XSS.
Types of CRLF Injection we cover
- HTTP response splitting
You inject a double CRLF to split the response in two and fully control the second: headers, body and even an XSS.
- Header injection
You add arbitrary headers (Location, Set-Cookie, CSP) where the server reflects your input in a header without sanitizing the CRLFs.
- Log injection
You put line breaks into values written to logs to forge entries, hide your trail or inject into a log viewer.
- Cookie injection
You inject your own Set-Cookie to fix the victim's session (session fixation) or overwrite security cookies.
How do you find and exploit CRLF Injection?
A practical playbook — from recon to proof of concept.
- 1
Locate input reflected in headers
Look for parameters that end up in a response header: redirects (Location), cookies, language headers or custom headers.
GET /redirect?url=/home → Location: /home - 2
Inject the CRLF
Put an encoded %0d%0a to force a line break. If a new header you control appears, the injection works.
?url=/home%0d%0aSet-Cookie:%20sessionid=attacker - 3
Split the response (response splitting)
With a double CRLF you close the header block and control the body of a whole second response.
?url=%0d%0aContent-Length:%200%0d%0a%0d%0a<html>defacement</html> - 4
Inject Set-Cookie or redirect
Fix a session cookie (session fixation) or add a redirect/CSP that degrades the page's security.
%0d%0aSet-Cookie:%20sessionid=FIXED%0d%0aLocation:%20https://evil.com - 5
Chain to XSS
If you control the body, inject HTML/JS to achieve a reflected XSS even on endpoints that return headers, not HTML.
?url=%0d%0aContent-Type:text/html%0d%0a%0d%0a<script>alert(document.domain)</script>
Loading labs...
View in full catalog →Frequently asked questions
What is CRLF Injection?
It's a vulnerability where you inject carriage-return and line-feed characters (\r\n, encoded as %0d%0a) into input the server places inside HTTP headers. Since those characters separate headers, the attacker can add their own headers or even split the response.
How is a CRLF Injection exploited?
You put %0d%0a into a parameter reflected in a header (for example a redirect) to inject a Set-Cookie or a new header. With a double CRLF you close the header block and control the response body, which allows defacement, session fixation or a reflected XSS.
How do you find CRLF Injection in bug bounty?
Identify parameters that end up in response headers (Location of redirects, language, cookies) and inject %0d%0a followed by a test header. If the response includes your injected header, it's vulnerable; then try a double CRLF to split the response and escalate to XSS.
How do you prevent CRLF Injection?
Strip or encode CR/LF characters from any input placed into headers, use the framework's APIs to set headers (not string concatenation), validate redirect URLs against an allowlist, and keep servers and proxies that already filter these characters updated.
Difference between CRLF Injection and XSS?
XSS injects code into the HTML the browser interprets. CRLF Injection injects line breaks into the HTTP headers: it operates at the protocol layer. Both can combine, since splitting the response with CRLF lets you control the body and put a reflected XSS payload there.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice CRLF Injection in real labs
Every CRLF Injection lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime