I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this:


results in the following headers:

Set-Cookie: cookie1=first_value
Set-Cookie: cookie2=second_value

These headers appear after the session id cookie header, so I figure I should be able to fix the session by using a cookie value like the following

first_value; another_cookie=another_value

URL encoding the space, semicolon and equals signs. However once the app sees the semicolon, it simply truncates up to that point, so the response header becomes:

Set-Cookie: first_value

My question is, what other delimiters might a browser accept, or what methods might allow the filter to be bypassed.

2 Answers 2


A CRLF Injection might work. You would use a URL like the following:

  • Good idea, but it doesn't work. The app truncates the query value up to the CRLF.
    – Slicedpan
    Mar 3, 2014 at 9:22

The semicolon is an old, mostly-obsolete value for the CGI record separator, but it's still recognized by many CGI scripts. Most likely what's happening is that your


is being interpreted as


and since the CGI script doesn't know what to do with a parameter named another_cookie, it ignores it. You can probably get around this by percent-encoding your semicolon:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .