CEH Web Application and Injection Attacks Practice Question
A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?
⚠ Common exam trap
CEH often tests whether candidates confuse response splitting with reflected XSS — both involve unsanitized input reflection, but response splitting specifically requires header reflection and CRLF injection, not body reflection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application reflects user input in the HTTP response headers
HTTP response splitting succeeds when three conditions align. Option A is correct because the application must reflect attacker-controlled input into HTTP response headers (e.g., a Location or Set-Cookie header), which is the injection point for the attack. Option E is correct because the reflected input must contain unsanitized CRLF sequences (%0d%0a), since these carriage-return/line-feed characters terminate the current header and let the attacker start new ones. Option D is correct because the injected CRLF must be sufficient to forge additional header lines and a second HTTP response body, which is the actual splitting effect. Option B is not required: reflection in the response body alone does not let the attacker manipulate header boundaries. Option C is irrelevant: HTTPS encrypts transport but does not prevent header injection, and the attack works over HTTP or HTTPS alike.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application reflects user input in the HTTP response headers
Why this is correct
For HTTP Response Splitting to occur, user-supplied input containing CRLF sequences must be directly incorporated into an HTTP response header. This allows an attacker to terminate the current header line and inject new, arbitrary header fields or even an entirely new response body. Without this direct reflection in the headers, the injected CRLF sequences would not be interpreted as control characters for the HTTP protocol, making the attack impossible.
- ✗
The application reflects user input in the HTTP response body
Why it's wrong here
While reflecting user input in the HTTP response body can lead to other vulnerabilities like Cross-Site Scripting (XSS) if not properly sanitized, it does not enable HTTP Response Splitting. CRLF sequences injected into the body are treated as part of the message content, not as protocol-level separators. Therefore, they cannot be used to terminate existing headers or forge new ones, preventing the splitting of the HTTP response.
- ✗
The application uses HTTPS exclusively
Why it's wrong here
The use of HTTPS exclusively encrypts the communication channel between the client and server, protecting data confidentiality and integrity during transit. However, HTTPS does not inherently prevent HTTP Response Splitting because the vulnerability arises from how the server-side application constructs HTTP responses based on user input. If the application logic is flawed and allows CRLF injection into headers, HTTPS will encrypt the malicious response but will not stop its generation or the client's interpretation of the split responses.
- ✓
The attacker can inject multiple header lines to create a second HTTP response
Why this is correct
The core objective of HTTP Response Splitting is to manipulate the server's response by injecting CRLF sequences, followed by new HTTP headers and potentially a new response body. This technique allows an attacker to effectively "split" the single legitimate response into two distinct responses from the client's perspective. The injected headers can then be used to set cookies, redirect users, or even deliver malicious content in the forged second response, impacting subsequent requests or cached content.
- ✓
The application does not sanitize or encode CRLF sequences (%0d%0a)
Why this is correct
The absence of proper sanitization or encoding for Carriage Return (CR, %0d) and Line Feed (LF, %0a) sequences is the fundamental flaw enabling CRLF injection. When an application fails to neutralize these characters in user input destined for HTTP headers, an attacker can use them to prematurely terminate an existing header line. This allows the injection of arbitrary new header fields or even a completely new HTTP response, leading directly to HTTP Response Splitting.
Go deeper
Related to this question
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.