New answers tagged injection
Yes, GlassFish does filter newline characters in headers. Tomcat does as well. I don't know about other servlet containers (Jetty, WebSphere, etc.) com.sun.net.httpserver does NOT filter newlines, so you can use that for your simulation.
If you are trying to catalog all possible attack inputs, creating a list of all form input fields would be incomplete and could lead you to having a false sense of security. There are many other potential origins of attack (parameters in the URL is a very common one). One thing that helped me when I began looking at website security was to start viewing it ...
Top 50 recent answers are included