Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
CRLF Injection
Injecting %0d%0a into responses — header injection, cookie setting, response splitting, and chained XSS from one newline pair. Wherever your input lands in response HEADERS, a newline rewrites the response structure.
Severity guide
Medium-high — header injection alone is solid; response splitting with XSS and cache poisoning escalate to high; many modern stacks have killed it (report what you can prove).
Where to look
entry points to test first01
Redirect Location values
?next= echoed into Location: — the classic CRLF home.
02
Set-Cookie parameters
Language/theme/utm params persisted into cookie values.
03
Custom response headers
X-* echoes, CORS headers built from Origin, filename headers on downloads.
04
Cache keys
Injected headers + caching = poisoned responses for other users.
05
Legacy stacks & proxies
Older app servers and custom proxies skip header-value escaping.
How to hunt it
in order, start to finishFind input reflected in headers
Redirect Location values, Set-Cookie parameters, custom header values — anywhere your input lands before the body.
Inject the newline pair
%0d%0a followed by header text: if the response carries your injected header, CRLF is confirmed.
Escalate to response splitting
A double %0d%0a%0d%0a starts a new body — inject a full second response with your own content.
Pair with the cache
Injected Set-Cookie or body content stored by a shared cache = poisoned pages for every user of that URL.
Bypass filters with Unicode
Fullwidth characters (嘊-style encodings) normalize to CR/LF on some stacks when validation checks raw bytes.
Filter & validation bypasses
when your first tries get blocked- 01%0d%0a blocked? Try bare %0a (LF-only) and bare %0d — some parsers split on either.
- 02Encoding applied twice? Double-encoded %250d%250a survives one decode pass.
- 03Unicode normalization? Fullwidth U+560A/U+560D forms decode into CR/LF on lenient stacks.
- 04Headers joined strictly? Response-splitting via Content-Length manipulation still lands when CL is injectable.
Impact ladder
what makes it payable- 01Arbitrary header injection — Set-Cookie (session fixation), Location (redirect).
- 02Response splitting — full attacker-controlled second response.
- 03Chained XSS — inject script into the split body.
- 04Cache poisoning — injected responses stored and served to other users.
Payloads
4 · from PayloadsAllTheThings%0d%0aLocation:%20http://myweb.comHeader injection — overrides the redirect target.
%0d%0aSet-Cookie: admin=trueCookie injection via header — session fixation primitive.
%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0aFull response splitting — smuggles an XSS payload into the body.
%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28document.domain%28%29%E5%98%BEFullwidth Unicode CRLF — normalized to real CR/LF by lenient decoders.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.