I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace to space (%20). I wanna to confirm whether I am right or I doing the wrong way. Any comment and and suggestion are welcome.

For your information

  • Server info: GlassFish Server Open Source Edition 4.0
  • Servlet version: 3.0
  • JSP version: 2.1
  • Java version: 1.7.0_51

Yes, GlassFish does filter newline characters in headers. Tomcat does as well. I don't know about other servlet containers (Jetty, WebSphere, etc.)

com.sun.net.httpserver does NOT filter newlines, so you can use that for your simulation.

  • I new to JSP. Do you mind to provide the sample code that I should replace sendRedirect() to simulate the CLRF attack? I can't find the method redirect in com.sun.net.httpserver or I miss understand something? Thank you. – overshadow Sep 9 '14 at 9:59
  • Did you get a basic web server working? Roughly speaking, you need to do httpExchange.getResponseHeaders().add("Location", "Blah\nBlah") – paj28 Sep 9 '14 at 10:06
  • Yup, my Web server is working. Do I need to change the server? Cause I am still using the GlassFish. I roughly got what you mean from the code. I will try it. Thank you. – overshadow Sep 9 '14 at 10:15
  • @overshadow - java2s.com/Tutorial/Java/0320__Network/… – paj28 Sep 9 '14 at 10:20
  • I see, you mean create a server to handle the http request. Haha. Thank you very much. Your help is very much appreciated. – overshadow Sep 9 '14 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.