All of the attacks we've discussed so far in this chapter involve placing strings in form fields that we know can cause havoc on back end databases. Many web services now create dynamic headers based on user input and session state, and a new class of attacks has surfaced to take advantage of the holes this can potentially open up. When attackers put their mind to it, they can inject information into headers that are actually akin to XSS in many cases.
As an example, HTTP is very rigorously mapped in its syntax, such that it treats carriage returns and line feeds as special delineation points between fields. An attacker might slip some of those in to inject their own arbitrary fields and deliver their payloads if the web server is not properly rejecting or sanitizing those inputs. This form of attack is called HTTP response splitting.
Another form of attack...