Collected research

Response Splitting Filter Evasion

Response Splitting Filter Evasion ha.ckers.org web application security lab

A redirector stripped any injection containing a forward slash, blocking both closing HTML tags and the usual Content-Type: text/html header needed to escalate response splitting into HTML injection. Shortening the header to Content-Type: html removes the slash and still gets the browser to parse the split response as markup.

Record

Document

Response Splitting Filter Evasion ha.ckers.org web application security lab

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2006 research round

Tags

• response-splitting
• filter-bypass
• header-injection
• xss
• open-redirect
• encoding
• waf-bypass
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.