Part of HTTP request that should be sent to server with
Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" attacker_controlled
Then this value is included into header of response to another request:
I'd want to make HTTP header injection here. How to encode CR/LF characters in
mulupart/formdata so they will appear as CR/LF at server side? How to make HTTP header injection here if it's not possible?
Edit: I've tried to change this request per @AndrewSmith's advice but it didn't work:
------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" Content-Transfer-Encoding: base64 YXR0YWNrZXJfY29udHJvbGxlZA==
In resulting HTML in place of
attacker_controlled there is
YXR0YWNrZXJfY29udHJvbGxlZA== (i.e. webserver didn't recognize Content-Transfer-Encoding)
So is there way to encode CR/LF characters?