Note: I know how HTTP Splitting works.
Note 2: I am not working in WebGoat. I am trying to make this on my own.
I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:
<?php header("Location: " . $_GET['page']); ?>
And then I enter the following URL:
But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.
Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.
So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??