{"id":1101,"date":"2023-04-07T13:50:05","date_gmt":"2023-04-07T18:50:05","guid":{"rendered":"https:\/\/www.searchevolution.com\/security\/?p=1101"},"modified":"2023-04-08T07:17:25","modified_gmt":"2023-04-08T12:17:25","slug":"exploitation-dune-application-web-en-utilisant-linjection-crlf","status":"publish","type":"post","link":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/","title":{"rendered":"Exploitation d&#8217;une application web en utilisant l&#8217;injection CRLF"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">M\u00e9thode d&#8217;exploitation par injection CRLF<\/h2>\n\n\n\n<p>La m\u00e9thode d&#8217;exploitation par injection CRLF (Carriage Return Line Feed) est une technique de piratage informatique qui consiste \u00e0 ins\u00e9rer des s\u00e9quences de caract\u00e8res sp\u00e9ciales dans des entr\u00e9es de donn\u00e9es HTTP pour provoquer des vuln\u00e9rabilit\u00e9s dans les applications web. Cette m\u00e9thode tire parti des caract\u00e8res CRLF, qui sont des codes de contr\u00f4le qui indiquent \u00e0 un navigateur web de passer \u00e0 la ligne suivante. Les pirates peuvent utiliser des s\u00e9quences CRLF pour injecter des commandes malveillantes, des scripts ou des liens dans les requ\u00eates HTTP et provoquer des attaques telles que le vol de session, le phishing et l&#8217;ex\u00e9cution de code arbitraire. Les d\u00e9veloppeurs peuvent pr\u00e9venir les attaques CRLF en validant et en filtrant correctement les entr\u00e9es de donn\u00e9es HTTP, en utilisant des biblioth\u00e8ques de codage s\u00e9curis\u00e9es et en limitant les caract\u00e8res sp\u00e9ciaux dans les entr\u00e9es utilisateur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D\u00e9finition des Line feeds<\/h2>\n\n\n\n<p>Les lines feed sur Windows sont %0D%0A (CR suivi de LF) tandis que sur Unix utilise seulement %0A (LF)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">GBK encoding<\/h2>\n\n\n\n<p>L&#8217;encodage GBK, \u00e9galement connu sous le nom de GuoBiao standard, est un encodage de caract\u00e8res utilis\u00e9 principalement en Chine. Il est une extension du jeu de caract\u00e8res GB2312, qui couvre les caract\u00e8res chinois les plus couramment utilis\u00e9s, et ajoute des milliers d&#8217;autres caract\u00e8res chinois, ainsi que des caract\u00e8res de langues asiatiques telles que le cor\u00e9en et le japonais. GBK utilise un codage \u00e0 double octet pour repr\u00e9senter les caract\u00e8res, ce qui permet de repr\u00e9senter un grand nombre de caract\u00e8res tout en conservant une compatibilit\u00e9 avec GB2312. Cependant, GBK ne peut repr\u00e9senter que les caract\u00e8res chinois simplifi\u00e9s, pas les caract\u00e8res traditionnels.<\/p>\n\n\n\n<p>\u560a = %E5%98%8A = \\u560a \u21d2 %0A (LF; Line Feed)<\/p>\n\n\n\n<p>\u560d = %E5%98%8D = \\u560d \u21d2 %0D (CR; Carriage Return)<\/p>\n\n\n\n<p>\u563e = %E5%98%BE = \\u563e \u21d2 %3E (&gt;) <\/p>\n\n\n\n<p>\u563c = %E5%98%BC = \\u563c \u21d2 %3C (&lt;) <\/p>\n\n\n\n<p>\u5622 = %E5%98%A2 = \\u5622 \u21d2 %22 (&#8216;) <\/p>\n\n\n\n<p>\u5627 = %E5%98%A7 = \\u5627 \u21d2 %27 (&#8220;)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exemple de  Payload pour injection CRLF<\/h2>\n\n\n\n<p>%0D%0A%20Set-Cookie:whoami=germain<br>%20%0D%0ASet-Cookie:whoami=germain<br>%0A%20Set-Cookie:whoami=germain<br>%2F%2E%2E%0D%0ASet-Cookie:whoami=germain<\/p>\n\n\n\n<p>Par exemple, l&#8217;injection pourrait se faire via le URL ou un des param\u00e8tres de la m\u00e9thode POST (ou GET)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;site.mysite.com\/%E5%98%8D%E5%98%8ASet-Cookie:whoami=thecyberneh%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%BCscript%E5%98%BEalert(1);%E5%98%BC\/script%E5%98%BE<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00e9thode utilis\u00e9 pour injection CRLF<\/h2>\n\n\n\n<p>Souvent , le firewall bloque les requ\u00eates contenant des requ\u00eates non autoris\u00e9s. On peut alors essayer d&#8217;encoder ces caract\u00e8res (par exemple avec l&#8217;encode GBK). On commence le payload avec un CRLF et on le fait suivre par exemple de Set-Cookie:whoami=germain (le payload utile) et de deux CRLF pour l&#8217;insertion d&#8217;une ligne blanche. Ce qui permet l&#8217;insertion d&#8217;une ligne blanche et signale la fin des headers au client. Apr\u00e8s les lignes blanches, on met notre payload HTML (toujours encod\u00e9 en GBK)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00e9thodes d&#8217;encodage<\/h2>\n\n\n\n<p>Vous pouvez essayer diff\u00e9rentes m\u00e9thodes d&#8217;encodage pour d\u00e9jouer le bastillon (firewall)<\/p>\n\n\n\n<ol>\n<li>UTF-8 (Unicode Transformation Format-8)<\/li>\n\n\n\n<li>UTF-16 (Unicode Transformation Format-16)<\/li>\n\n\n\n<li>UTF-32 (Unicode Transformation Format-32)<\/li>\n\n\n\n<li>GBK (GuoBiao standard), qui est une extension du jeu de caract\u00e8res GB2312 et permet de repr\u00e9senter des milliers de caract\u00e8res chinois simplifi\u00e9s, ainsi que des caract\u00e8res de langues asiatiques telles que le cor\u00e9en et le japonais.<\/li>\n\n\n\n<li>GB18030, une extension de GBK qui permet de repr\u00e9senter tous les caract\u00e8res chinois, y compris les caract\u00e8res traditionnels.<\/li>\n\n\n\n<li>BIG5 (Chinese Industrial Standard), qui est utilis\u00e9 principalement \u00e0 Taiwan et Hong Kong pour repr\u00e9senter les caract\u00e8res chinois traditionnels.<\/li>\n\n\n\n<li>EUC-JP (Extended Unix Code-Japan), qui est utilis\u00e9 pour repr\u00e9senter les caract\u00e8res japonais.<\/li>\n\n\n\n<li>EUC-KR (Extended Unix Code-Korea), qui est utilis\u00e9 pour repr\u00e9senter les caract\u00e8res cor\u00e9ens.<\/li>\n\n\n\n<li>ISO-8859-1 (International Organization for Standardization), \u00e9galement connu sous le nom de Latin-1, qui est utilis\u00e9 pour repr\u00e9senter les caract\u00e8res europ\u00e9ens occidentaux.<\/li>\n\n\n\n<li><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">En image<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1268\" height=\"713\" src=\"https:\/\/www.searchevolution.com\/security\/wp-content\/uploads\/2023\/04\/crlf-injection.png\" alt=\"\" class=\"wp-image-1102\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Ressources<\/h2>\n\n\n\n<p><a href=\"https:\/\/owasp.org\/www-community\/vulnerabilities\/CRLF_Injection\">Exploiter des vuln\u00e9rabilit\u00e9s CRLF<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.searchevolution.com\/security\/2021\/07\/27\/exploiter-les-vulnerabilites-xss\/\">Exploiter des vuln\u00e9rabilit\u00e9s XSS<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.praetorian.com\/blog\/using-crlf-injection-to-bypass-akamai-web-app-firewall\/\">Exploiter en compressant les donn\u00e9es pour outrepasser un bastillon<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>M\u00e9thode d&#8217;exploitation par injection CRLF La m\u00e9thode d&#8217;exploitation par injection CRLF (Carriage Return Line Feed) est une technique de piratage informatique qui consiste \u00e0 ins\u00e9rer des s\u00e9quences de caract\u00e8res sp\u00e9ciales dans des entr\u00e9es de donn\u00e9es HTTP pour provoquer des vuln\u00e9rabilit\u00e9s dans les applications web. Cette m\u00e9thode tire parti des caract\u00e8res CRLF, qui sont des codes de contr\u00f4le qui indiquent \u00e0 un navigateur web de passer \u00e0 la ligne suivante. Les pirates peuvent utiliser des s\u00e9quences CRLF pour injecter des commandes malveillantes, des scripts ou des liens dans les requ\u00eates HTTP et provoquer des attaques telles que le vol de session, <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Exploitation d&#039;une application web en utilisant l&#039;injection CRLF -<\/title>\n<meta name=\"description\" content=\"L&#039;injection CRLF permet d&#039;exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d&#039;autres failles (XSS)\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/\" \/>\n<meta property=\"og:locale\" content=\"fr_CA\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exploitation d&#039;une application web en utilisant l&#039;injection CRLF -\" \/>\n<meta property=\"og:description\" content=\"L&#039;injection CRLF permet d&#039;exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d&#039;autres failles (XSS)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/\" \/>\n<meta property=\"og:site_name\" content=\"S\u00e9curiser votre site\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-07T18:50:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-08T12:17:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.searchevolution.com\/security\/wp-content\/uploads\/2023\/04\/crlf-injection.png\" \/>\n<meta name=\"author\" content=\"Germain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Germain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimation du temps de lecture\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/\",\"url\":\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/\",\"name\":\"Exploitation d'une application web en utilisant l'injection CRLF -\",\"isPartOf\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\"},\"datePublished\":\"2023-04-07T18:50:05+00:00\",\"dateModified\":\"2023-04-08T12:17:25+00:00\",\"author\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\"},\"description\":\"L'injection CRLF permet d'exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d'autres failles (XSS)\",\"breadcrumb\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/#breadcrumb\"},\"inLanguage\":\"fr-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.searchevolution.com\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Exploitation d&#8217;une application web en utilisant l&#8217;injection CRLF\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\",\"url\":\"https:\/\/www.searchevolution.com\/security\/\",\"name\":\"S\u00e9curiser votre site\",\"description\":\"Conna\u00eetre son ennemi\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\",\"name\":\"Germain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-CA\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"caption\":\"Germain\"},\"sameAs\":[\"https:\/\/www.searchevolution.com\/security\"],\"url\":\"https:\/\/www.searchevolution.com\/security\/author\/germain\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Exploitation d'une application web en utilisant l'injection CRLF -","description":"L'injection CRLF permet d'exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d'autres failles (XSS)","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/","og_locale":"fr_CA","og_type":"article","og_title":"Exploitation d'une application web en utilisant l'injection CRLF -","og_description":"L'injection CRLF permet d'exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d'autres failles (XSS)","og_url":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/","og_site_name":"S\u00e9curiser votre site","article_published_time":"2023-04-07T18:50:05+00:00","article_modified_time":"2023-04-08T12:17:25+00:00","og_image":[{"url":"https:\/\/www.searchevolution.com\/security\/wp-content\/uploads\/2023\/04\/crlf-injection.png"}],"author":"Germain","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Germain","Estimation du temps de lecture":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/","url":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/","name":"Exploitation d'une application web en utilisant l'injection CRLF -","isPartOf":{"@id":"https:\/\/www.searchevolution.com\/security\/#website"},"datePublished":"2023-04-07T18:50:05+00:00","dateModified":"2023-04-08T12:17:25+00:00","author":{"@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8"},"description":"L'injection CRLF permet d'exploiter les applications WEB (m\u00eame avec un pare-feu) pour exploiter d'autres failles (XSS)","breadcrumb":{"@id":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/#breadcrumb"},"inLanguage":"fr-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.searchevolution.com\/security\/2023\/04\/07\/exploitation-dune-application-web-en-utilisant-linjection-crlf\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.searchevolution.com\/security\/"},{"@type":"ListItem","position":2,"name":"Exploitation d&#8217;une application web en utilisant l&#8217;injection CRLF"}]},{"@type":"WebSite","@id":"https:\/\/www.searchevolution.com\/security\/#website","url":"https:\/\/www.searchevolution.com\/security\/","name":"S\u00e9curiser votre site","description":"Conna\u00eetre son ennemi","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-CA"},{"@type":"Person","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8","name":"Germain","image":{"@type":"ImageObject","inLanguage":"fr-CA","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","caption":"Germain"},"sameAs":["https:\/\/www.searchevolution.com\/security"],"url":"https:\/\/www.searchevolution.com\/security\/author\/germain\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/1101"}],"collection":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/comments?post=1101"}],"version-history":[{"count":7,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/1101\/revisions"}],"predecessor-version":[{"id":1111,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/1101\/revisions\/1111"}],"wp:attachment":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/media?parent=1101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/categories?post=1101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/tags?post=1101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}