Live briefing

Everything about HTTP response splitting

Class of internet software vulnerability

HTTP response splitting is a form of web application vulnerability, resulting from the failure of the application or its environment to properly sanitize input values. It can be used to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits. Wikipedia →

🧭 Start here: a 6-step reading path

Read the overview: HTTP response splittingA 5-minute orientation
Pick up a classic book: The web application hacker's handbookThe most-reprinted book on the subject
Go sideways: Code injectionA closely related topic
Go sideways: HTTP header injectionA closely related topic

📖 Definitions

No dictionary entry for this exact phrase.

🗂️ The subject at a glance

Prevention

🏆 Landmark papers (most cited)

No matching papers found.

📚 Books worth reading

The web application hacker's handbookDafydd Stuttard, Marcus Pinto · 2007
Air ForceUnited States. Army Air Forces., Air Force Association. · 1943
RESTful Web ServicesLeonard Richardson, Sam Ruby · 2007
TCP/IP IllustratedW. Richard Stevens, Kevin R. Fall · 1993
Web application security is a stackLori Mac Vittie · 2015
IMPACTS OF RURAL ELECTRIFICATION IN RWANDA · 2015
📕The effect of foreign intervention on Somali conflict in Mogadishu, Somalia · 2014

Ranked by number of editions on Open Library, a rough measure of how lasting a book is.

🔗 Related topics

Code injection Code injection is a computer security exploit where a program fails to correctly process external data, such as user input, causing it to interpret the…
HTTP header injection HTTP header injection is a general class of web application security vulnerability which occurs when Hypertext Transfer Protocol (HTTP) headers are dynamically…
Cross-site scripting Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side…
Cross-site request forgery Cross-site request forgery (CSRF, sometimes pronounced sea-surf) is a type of malicious exploit of a website or web application where unauthorized commands…
Path traversal attack A directory traversal, path traversal, or dot-dot-slash attack exploits insufficient security validation or sanitization of user-supplied file names, such…
SQL injection In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into…
File inclusion vulnerability A File Inclusion Vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time…
Double encoding Double encoding is the act of encoding data twice in a row using the same encoding scheme. It is usually used as an attack technique to bypass authorization…