Questions tagged [response-splitting]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
145 views

In which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message?

I wondered in which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message? The examples I saw all allowed full replacement of the HTTP response,...
user avatar
  • 422
9 votes
1 answer
1k views

Does HTTP/2 prevent security vulnerabilites like CRLF injection?

Which vulnerabilites does HTTP/2 prevent? More specifically: Does it prevent HTTP request smuggling? Does it prevent HTTP response splitting / CRLF injection?
user avatar
0 votes
2 answers
220 views

Is there an impact of CRLF injection on static sites?

I found CRLF injection on a site but it doesn't has any login, session or anything or that sort. I wonder if there's any way to prove impact of CRLF injection here. Something that I think can be done ...
user avatar
  • 1
0 votes
0 answers
516 views

HTTP Response Header Injection: Confirmed but not able to exploit

There is an application which is vulnerable to HTTP Response Header Injection. Here is my observation till now. If I browse to the URL http://abc.com/abcd/xyz%0d%0aABC , I get a 302 redirection ...
user avatar
  • 1,781
1 vote
0 answers
88 views

Exploiting response splitting on a non redirect

I was messing around with cookie based CRLF locally and was wondering what the possible ramifications are for pages that don't have 302s (And just return 200). I could indeed break the page from ...
user avatar
  • 43
2 votes
1 answer
936 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
user avatar
  • 21
7 votes
1 answer
2k views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilities with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
user avatar
  • 73
6 votes
1 answer
1k views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
user avatar
  • 61
3 votes
1 answer
427 views

HTTP Response splitting - is it browser caching or server caching issue?

I am trying to wrap my head around HTTP Response splitting. Although using WebGoat etc. I was able to learn how to do it in practice, but I guess I am still confused with some very fundamental ...
user avatar
  • 1,472
9 votes
4 answers
2k views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
user avatar
  • 377
0 votes
1 answer
996 views

How to escape a cookie to cause split response? [closed]

A website takes the following request and sets the "_Add_User" as a cookie in the response: Request GET /cgi-bin/webscr?cmd=_Add_User HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows ...
user avatar
  • 377
1 vote
0 answers
39 views

Is Webgoat's HTTP Splitting Attack corrupt? [duplicate]

This link describes my problem better: https://code.google.com/p/webgoat/issues/detail?id=42 I was doing the HTTP Splitting exercise in WebGoat. In this exercise, when you send a malformed URL, you ...
user avatar
  • 123
1 vote
3 answers
700 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
user avatar
  • 123
5 votes
4 answers
3k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
user avatar
  • 632
1 vote
2 answers
2k views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
user avatar
  • 109
3 votes
1 answer
1k views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET HTTP ...
user avatar
  • 4,774
9 votes
2 answers
4k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in attacker ...
user avatar
1 vote
2 answers
4k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
user avatar
  • 189
5 votes
2 answers
232 views

What kind of cache-related attacks exists on the Web?

What kind of cache-related attacks exists in modern Web world? The only one I'm aware of is Cache Poisoning. Is there anything else I should be worrying about?
user avatar
8 votes
1 answer
4k views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: Response.Redirect("/MySite/Default.aspx?lang=foobar%0d%0aContentLength:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%...
user avatar