Crlf Injection

When user input reaches HTTP response headers, redirects, or logs without proper sanitization, this playbook shows you how to exploit CRLF injection to split responses and inject new headers or body content. It covers the classic attacks like session fixation via Set-Cookie injection, XSS through double CRLF body splitting, and cache poisoning on CDNs. The encoding bypass section is solid, covering double encoding, Unicode tricks, and LF-only variants when filters block the standard %0D%0A. It also routes you to the ghost-bits-cast-attack skill for Java services where you can use Unicode characters that decode to CRLF bytes. Honestly, this is one of those underrated vulns that scanners miss but chains beautifully into higher impact exploits.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill crlf-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: CRLF Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: CRLF injection (HTTP response splitting) techniques. Covers header injection, response body injection via double CRLF, XSS escalation, cache poisoning, and encoding bypass. Often overlooked by scanners but chains into XSS, session fixation, and cache attacks.

0. RELATED ROUTING

ghost-bits-cast-attack when the target is a Java service and %0D%0A / \r\n encodings are WAF-blocked — substituting 瘍 (U+760D, low byte \r) and 瘊 (U+760A, low byte \n) injects a real CRLF through Angus Mail / Jakarta Mail SMTP, Apache HttpClient headers, JDK HttpServer responses, and ActiveJ HTTP (re-enables Jira CVE-2025-57733 and JDK CVE-2026-21933 classes)

1. CORE CONCEPT

CRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.

Normal: Location: /page?url=USER_INPUT
Attack: Location: /page?url=%0D%0ASet-Cookie:admin=true
Result: Two headers — Location + injected Set-Cookie

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
First seen: May 16, 2026