CRLF Injection Bug Bounty 2026 — Full Exploit Guide (XSS, Response Splitting) BB Day 24

This article is a comprehensive technical guide to finding, testing, and escalating CRLF injection vulnerabilities in bug bounty programs. It covers how attackers inject carriage return and line feed characters (%0d%0a) into HTTP response headers to add arbitrary headers, split responses, or inject malicious content. The article demonstrates that CRLF injection payouts vary dramatically based on impact escalation—from $100 for basic header injection to $10,000+ for cached XSS—making systematic escalation critical to maximizing bug bounty rewards.

• HTTP header structure enables CRLF attacksHTTP/1.1 separates headers with CRLF (rn) and terminates the header section with double CRLF (rnrn). When applications concatenate unsanitized user input directly into header values—particularly in Location, Set-Cookie, or custom headers—an attacker can inject %0d%0a characters to create new headers or, with double CRLF, inject an entirely new response body. The vulnerability stems from servers treating every occurrence of this two-character sequence as a structural boundary.
• Redirect parameters are primary injection targetsCommon vulnerable parameters include next=, return=, redirect=, url=, r=, and goto= on login endpoints, logout flows, OAuth callbacks, and post-action redirects. The article instructs testers to systematically map all redirect endpoints using Burp Suite's HTTP history filtered by 302 responses, then test each parameter with a basic CRLF payload like %0d%0aX-CRLF-Test:injected. Because these endpoints are designed to handle redirects, their parameter values naturally flow into response headers, creating direct injection points.
• Set-Cookie injection demonstrates session fixationBy injecting a Set-Cookie header via CRLF, an attacker forces a victim's browser to store a known session value before login. The attack chain works by: attacker crafts a malicious link with CRLF payload, victim clicks it and receives the injected Set-Cookie header, victim logs in causing the app to associate the attacker's session value with the victim's authenticated account, and attacker uses that same session value to access the victim's account. The article notes this is the most reliably demonstrable high-impact escalation in 2026, more reliable than response splitting which varies by br
• Response splitting injects arbitrary HTML and JavaScriptBy using a double CRLF sequence followed by Content-Length: 0 and another full HTTP response structure, an attacker can terminate the original response headers and inject a completely new response with arbitrary HTML and JavaScript. The payload structure includes injected response headers, another double CRLF to end those headers, and then malicious content like that executes on the target domain. The article warns this can cause cache poisoning affecting all users if the injected response is cached.
• WAF evasion requires testing multiple encodingsStandard %0d%0a encoding is often blocked, but alternative encodings bypass filters: double URL-encoded %250d%250a (decoded twice by some parsers), LF-only %0a (vulnerable on older Apache), Unicode %u000d%u000a, and CRLF plus tab %0d%0a%09. The article emphasizes that if basic CRLF is blocked, most testers stop testing and mark endpoints as secure; however, systematic bypass testing of at least double-encoding, LF-only, and Unicode variants finds CRLF injections others miss. Testing different payload positions (beginning of value, after a slash, with different context) also helps.
• Payout scales directly with demonstrated impactThe article establishes a severity escalation ladder: basic header injection ($50-200), Set-Cookie injection ($300-1,500), XSS via response splitting ($1,000-5,000), and cache poisoning XSS ($3,000-15,000+). The same injection point tested at only the lowest level might yield $100, but escalated to Set-Cookie fixation yields $1,000, and further escalated to cached XSS yields $5,000-10,000. This creates a financial incentive to invest time in escalation testing rather than filing reports at the lowest impact level discovered.
• Manual testing with Burp Repeater confirms exploitabilityThe article prescribes capturing both request and response panes in Burp Suite Repeater as evidence: the request showing the payload with %0d%0a or bypass encoding, and the response showing the injected header appearing in the response headers section. Additionally, for Set-Cookie injection, screenshotting the injected cookie in the browser's Application tab (Cookies storage) provides more compelling evidence than a Burp response alone. This manual workflow builds testing discipline and ensures bypass encodings are tested systematically.
• Bug reports must demonstrate maximum impact before submissionThe article provides a report structure requiring: title including endpoint and highest-impact finding, severity level based on demonstrated impact (not theoretical), description in non-technical terms, exact numbered reproduction steps that require no interpretation, evidence screenshots showing payload and injected content, business impact explanation written for non-security managers, and remediation guidance. The article stresses self-assessment: if reproduction requires guesswork, the steps aren't precise enough; if impact uses technical jargon, rewrite it for non-security audiences. Repo

Bottom line: CRLF injection remains a high-payout vulnerability because most testers file reports at the basic header-injection level without attempting escalation to Set-Cookie fixation or response splitting XSS—yet the same injection point escalated to higher impact can yield 10-100x higher payouts. Success in CRLF bug bounty hunting depends on systematic bypass testing when standard %0d%0a encoding is blocked, disciplined escalation from basic injection through Set-Cookie to response splitting, and precis