New answers tagged injection
It's impossible to say from your "screenshot" above, but I'd say you're not getting back 0x0D 0x0A after the location, but instead the high bytes you've sent (0x8A 0x8D), including your Set-Cookie. And you're not interpreting the returned high bytes as CRLF either, so your user agent interprets the Set-Cookie as the non-host-part of the URL. Try switching ...
I wrote a tool (in C# and powershell using reflection) that walks thread stacks and reports where the function calls are loading from using GetMappedFile. Shows where all functions are executing from (i.e. which dll and where on disk) if the MappedFile property is blank, most likely reflectively loaded ;) https://github.com/secabstraction/PowerWalker
Top 50 recent answers are included