Signature Detail

HTTP: Response Splitting in HTTP Variable

This signature detects HTTP requests with encoded characters that are consistent with an HTTP response splitting attack. Attackers can execute script code on the target's browser or poison an HTTP cache server. Note: Some Web applications might use these characters legitimately.

Extended Description

Use of HTTP response splitting could enable a remote attacker to launch a cross-site scripting attack, poison a server's or a browser's cache, deface a web page, or hijack user information.

References

• URL: http://www.sanctuminc.com/pdf/Whitepaper_HTTPResponse.pdf