Planet DesKel

DesKel's official page for CTF write-up, Electronic tutorial, review and etc.

12 September 2020 write-up: old-38

1 minutes to read
Link point tag
old-38 100 CRLF Injection

Welcome back to another CTF challenge. Today we are going for the first-ever CRLF injection challenge in this server.


At first glance, we have no idea what is this page about except the page title, ‘log injection’. Sending any input except admin returns nothing. After checking the source code, the log seems to be displayed on admin.php



Yikes! Our IP address and message are showing on the logging page. After spending some time figuring out the way, my final guess is logging admin using our public IP, however, it seems that the admin is being filtered by the page.


Alright, Carriage Return Line Feed (CRLF) injection a.k.a /r/n injection might be the way. With CRLF injection, we are creating one actual log and another one is a fake log. First of all, let change the input tag to the Textarea tag and increase the input size.


Textarea HTML tag allows us to perform CRLF injection. Input a dummy and press enter followed by the payload **:admin**


Visit or refresh the admin.php.


tags: - crlf_injection

Thanks for reading. Follow my twitter for latest update

If you like this post, consider a small donation. Much appreciated. :)


© 2020 DesKel