Note: I know how HTTP Splitting works.

Note 2: I am not working in WebGoat. I am trying to make this on my own.

I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:

header("Location: " . $_GET['page']);

And then I enter the following URL:


But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.

Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.

So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??

3 Answers 3


This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here https://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt:

 [...] Although response splitting is not specific to PHP, the PHP interpreter 
contains protection against the attack since version 4.4.2 and 5.1.2. [1]

Doesn't look like a browser issue: if the server accepts a newline in input, and spits that straight out into an HTTP header without escaping that would be purely server-side vulnerability.

This particular header-splitting attack is now mitigated in PHP itself. The header() function will give you an error if you pass a string with a newline in.


HTTP Splitting attacks are focused on server side as consequence of a bad input parsing and vulnerable functions. For a browser it is impossible to guess when a header is bad or not. These are sent by the server.

Probably you read this OWASP HTTP Response Splitting

HTTP response splitting occurs when: Data enters a web application through an untrusted source, most frequently an HTTP request. The data is included in an HTTP response header sent to a web user without being validated for malicious characters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .