Header injection attempts (hdrinj)

Header injection attempts

Input patterns suggest attempts to manipulate headers or downstream header parsing.

Attack family · Header injection and intermediary confusion Phase · Reconnaissance and exploit staging Risk · High

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.

Focus

Header-structure manipulation and delimiter abuse
Proxy and downstream parsing confusion patterns
Smuggling-adjacent and cache/proxy edge header anomalies

Logic

The annotator deduplicates by rule and keeps the strongest header finding.
It is most valuable around reverse proxies, caches, and layered application stacks.
Signals are grouped so one malformed request does not explode into noisy duplicates.

Attack Family

Header injection and intermediary confusion

Phase · Reconnaissance and exploit staging Risk · High

Headers are where browsers, proxies, CDNs, caches, WAFs, and applications negotiate reality. If an attacker can confuse that layer, they can sometimes split one request into multiple interpretations.

Damage Patterns

Header manipulation can contribute to cache poisoning, request smuggling style behavior, auth confusion, and proxy bypasses.
The damage is especially sharp in layered stacks where each hop parses the same bytes differently.

Incident Lore

Some of the most technically elegant web attacks have come from tiny header ambiguities that turned shared infrastructure against itself.
These incidents tend to hurt badly because they hide in the seams between teams: CDN, proxy, app, and platform.

How To Read It

Interpret this as an attempt to manipulate how intermediaries or the app parse request headers.

Defender Takeaway

Treat this as a stack-boundary signal. The attacker is testing whether your intermediaries agree on what the request means.

Catalog Definition

Flags indicators consistent with header injection or header-structure manipulation, such as suspicious delimiter/control-character patterns and payloads aimed at confusing proxies or application parsing. This can be relevant to cache/proxy edge behavior and request smuggling-adjacent classes. Present evidence carefully (avoid excessive payload disclosure) and interpret with endpoint and repetition context.

Header injection attempts

What This Annotator Watches

10 Most Recent Real Samples

Confirm Action