CEH Web Application and Injection Attacks Practice Question
A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application reflects user input in the HTTP response headers
HTTP response splitting requires that attacker input is reflected in the response headers (e.g., via CRLF injection). The application must not sanitize CRLF sequences. The attacker can then inject headers to separate the response into two HTTP responses, enabling cache poisoning or XSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application reflects user input in the HTTP response headers
Why this is correct
For HTTP Response Splitting to occur, user-supplied input containing CRLF sequences must be directly incorporated into an HTTP response header. This allows an attacker to terminate the current header line and inject new, arbitrary header fields or even an entirely new response body. Without this direct reflection in the headers, the injected CRLF sequences would not be interpreted as control characters for the HTTP protocol, making the attack impossible.
- ✗
The application reflects user input in the HTTP response body
Why it's wrong here
While reflecting user input in the HTTP response body can lead to other vulnerabilities like Cross-Site Scripting (XSS) if not properly sanitized, it does not enable HTTP Response Splitting. CRLF sequences injected into the body are treated as part of the message content, not as protocol-level separators. Therefore, they cannot be used to terminate existing headers or forge new ones, preventing the splitting of the HTTP response.
- ✗
The application uses HTTPS exclusively
Why it's wrong here
The use of HTTPS exclusively encrypts the communication channel between the client and server, protecting data confidentiality and integrity during transit. However, HTTPS does not inherently prevent HTTP Response Splitting because the vulnerability arises from how the server-side application constructs HTTP responses based on user input. If the application logic is flawed and allows CRLF injection into headers, HTTPS will encrypt the malicious response but will not stop its generation or the client's interpretation of the split responses.
- ✓
The attacker can inject multiple header lines to create a second HTTP response
Why this is correct
The core objective of HTTP Response Splitting is to manipulate the server's response by injecting CRLF sequences, followed by new HTTP headers and potentially a new response body. This technique allows an attacker to effectively "split" the single legitimate response into two distinct responses from the client's perspective. The injected headers can then be used to set cookies, redirect users, or even deliver malicious content in the forged second response, impacting subsequent requests or cached content.
- ✓
The application does not sanitize or encode CRLF sequences (%0d%0a)
Why this is correct
The absence of proper sanitization or encoding for Carriage Return (CR, %0d) and Line Feed (LF, %0a) sequences is the fundamental flaw enabling CRLF injection. When an application fails to neutralize these characters in user input destined for HTTP headers, an attacker can use them to prematurely terminate an existing header line. This allows the injection of arbitrary new header fields or even a completely new HTTP response, leading directly to HTTP Response Splitting.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.