CRLF-Powered Desync Attacks Beheading HTTP Streams

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/crlf-powered-desync-attacks
• Blog Title: CRLF-Powered Desync Attacks: Beheading HTTP Streams
• Suggested Section: Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with a subsection for CRLF-powered request splitting and desynchronization and a cross-reference from CRLF Injection

🎯 Content Summary

Overview and impact

This research demonstrates that CRLF-based HTTP header injection is not merely an open-redirect or low-impact response-splitting issue. When attacker-controlled data is decoded and inserted into an HTTP/1 message, it can provide control over headers, request boundaries, response boundaries, and message framing. The authors escalate these primitives into HTTP request splitting, response queue poisoning (RQP), CL.TE and 0.CL desynchronization, request tunnelling, cac...

🔧 Technical Details

CRLF injection through decoded upstream values: If a proxy URL-decodes attacker-controlled data before concatenating it into an HTTP/1 request or response, encoded %0d%0a becomes literal CRLF and can create headers, terminate header blocks, or introduce new messages. Nginx configurations using $uri in proxy_pass or return are a common source. Probe for deterministic upstream responses using an invalid version for 505, unsupported transfer coding for 501, invalid Expect for 417, or malformed Content-Length for 400. Test paths, cookies, parameters, regex captures and values copied into custom headers.

Request splitting and response queue poisoning: Inject two CRLF pairs followed by a complete second request. One front-end request then generates two upstream responses, shifting the response queue so later users receive responses intended for other clients. Repeating the...

🤖 Agent Actions

Done.

Updated:

• src/pentesting-web/http-request-smuggling/README.md

Added:

• A new CRLF-powered request splitting and desynchronization subsection
• Detection guidance for 505 / 501 / 417 / 400 probes
• Escalation notes for:
  • request splitting / RQP
  • single-header CRLF-powered CL.TE
  • blind tunnelling disclosure with Expect: 100-continue
  • browser-sendable CRLF desyncs
• Reference [22] to the PortSwigger research

Verified:

• Diff looks correct
• Citation/reference numbering is consistent
• Only one file was modified

Note:

• mdbook build couldn’t be run because mdbook is not installed in this environment (/bin/sh: 1: mdbook: not found).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/crlf-powered-desync-attacks

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with a subsection for CRLF-powered request splitting and desynchronization and a cross-reference from CRLF Injection".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0