Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:

Content-Disposition: form-data; name="subject"


Then this value is included into header of response to another request:

Content-Disposition:attachment; filename="attacker_controlled.html"

I'd want to make HTTP header injection here. How to encode CR/LF characters in mulupart/formdata so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?

Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:

Content-Disposition: form-data; name="subject"
Content-Transfer-Encoding: base64


In resulting HTML in place of attacker_controlled there is YXR0YWNrZXJfY29udHJvbGxlZA== (i.e. webserver didn't recognize Content-Transfer-Encoding)

So is there way to encode CR/LF characters?

share|improve this question
Could you simply post your full request and full response you got now and tell what is the expected response? – Andrew Smith Jul 15 '12 at 12:14
@AndrewSmith What info do you need besides of already provided? Full HTTP request and response are too long – Andrei Botalov Jul 15 '12 at 17:03
I can't tell if you're trying to figure out how to attack some existing system, or if you're trying to figure out how to defend your system. The answers will differ according to your goal (attack or defense). – D.W. Jul 15 '12 at 22:30
up vote 3 down vote accepted

How are newlines a problem when there is a boundary defined? The thing with this kind of HTTP packet is that it's binary safe, meaning that the entire 0..255 ASCII range can be used with no problem; including newlines and carriage returns. As long as the specified boundary is not encountered, the server or browser will simply see the characters as part of the data and not as any separator.

Only if an attacker can control the name in the content-disposition header, you would need to strip newlines there. Or if he can guess the boundary to be used, you should make sure the boundary is dynamic or is simply stripped.

share|improve this answer
+1 you are correct, this is only a problem if he was building the header. – rook Jul 15 '12 at 18:06

It's 7bit encoding I believe:

Please correct me if I am wrong.

It can be also whatever server supports: 8bit, etc, you just put a header and see for yourself how it works, and see what Content-Transfer-Encoding you specify as well.

share|improve this answer
So is it possible to encode CR/LF characters? – Andrei Botalov Jul 9 '12 at 18:24
Yes it is, but depends on the encoding format you've got. – Andrew Smith Jul 9 '12 at 20:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.