thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

CRLF Injection

Injection of carriage return and line feed characters into data used in protocol headers or logs.

Definition

CRLF (\r\n) sequences can split HTTP headers, set arbitrary cookies, or forge log entries. Mitigations include rejecting or encoding CR and LF in header values, using framework header APIs that validate input and encoding log data.

Example

A redirect parameter containing %0d%0a injects a Set-Cookie header into the response.

Exam tip

Leads to HTTP response splitting and log forging.

Related terms