I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this:
results in the following headers:
Set-Cookie: cookie1=first_value Set-Cookie: cookie2=second_value
These headers appear after the session id cookie header, so I figure I should be able to fix the session by using a cookie value like the following
URL encoding the space, semicolon and equals signs. However once the app sees the semicolon, it simply truncates up to that point, so the response header becomes:
My question is, what other delimiters might a browser accept, or what methods might allow the filter to be bypassed.