mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
# CRLF Injection / HTTP Response Splitting Detection Module
|
|
|
|
id: crlf-injection
|
|
info:
|
|
name: CRLF Injection Detection
|
|
author: sif
|
|
severity: medium
|
|
description: Detects CRLF injection and HTTP response splitting via header reflection
|
|
tags: [crlf, injection, response-splitting, owasp-top10]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/?url={{payload}}"
|
|
- "{{BaseURL}}/?redirect={{payload}}"
|
|
- "{{BaseURL}}/?next={{payload}}"
|
|
- "{{BaseURL}}/?page={{payload}}"
|
|
- "{{BaseURL}}/?dest={{payload}}"
|
|
- "{{BaseURL}}/?r={{payload}}"
|
|
- "{{BaseURL}}/{{payload}}"
|
|
|
|
payloads:
|
|
- "%0d%0aX-Sif-Injected:1"
|
|
- "%0d%0aX-Sif-Injected%3A1"
|
|
- "%0aX-Sif-Injected:1"
|
|
- "test%0d%0aX-Sif-Injected:1"
|
|
|
|
threads: 10
|
|
|
|
# proof: anchor to a header LINE that starts with our injected key. a real
|
|
# split promotes "X-Sif-Injected:1" to its own header line; reflecting the
|
|
# payload into some other header's VALUE (go rewrites the CR/LF to nothing, so
|
|
# no split) leaves the text mid-line, where "^" cannot match. getPart renders
|
|
# one "Key: value" per line, so line-start distinguishes split from reflection.
|
|
matchers:
|
|
- type: regex
|
|
part: header
|
|
regex:
|
|
- "(?m)^X-Sif-Injected:"
|