Have you ever seen HTTP Response Splitting in laboratory environment?
There are many examples for HTTP Response Splitting vulnerability.
I used old PHP and managed to get 2 responses from server that are visible in wireshark:
HTTP/1.1 302 Found Date: Sun, 30 Aug 2015 11:56:15 GMT Server: Apache/2.0.47 (Win32) mod_ssl/2.0.47 OpenSSL/0.9.7b PHP/4.3.3RC2-dev X-Powered-By: PHP/4.3.3RC2-dev Location: Content-Length: 0 HTTP/1.1 200 OK Content-Type: text/html Content-Length: 25 <html>Hacked !</html> Content-Length: 0 Content-Type: text/html; charset=ISO-8859-1
If I render it in BurpSuite then I see html from second response, but the browser does not show it and has different behaviour instead depends on browser.
When I look at the response in Live HTTP Headers extension for FireFox I see that the string "HTTP/1.1 200 OK" is absent.
How is it possible to see HTTP Response Splitting for Location header in browser?