Lab: Web cache poisoning with an unkeyed header
This lab is vulnerable to web cache poisoning because it handles input from an unkeyed header in an unsafe way. An unsuspecting user regularly visits the site's home page. To solve this lab, poison the cache with a response that executes
alert(document.cookie) in the visitor's browser.
This lab supports the
- With Burp running, load the website's home page
In Burp, go to "Proxy" > "HTTP history" and study the requests and responses that you generated. Find the
GETrequest for the home page and send it to Burp Repeater.
Add a cache-buster query parameter, such as
X-Forwarded-Hostheader with an arbitrary hostname, such as
example.com, and send the request.
Observe that the
Replay the request and observe that the response contains the header
X-Cache: hit. This tells us that the response came from the cache.
Go to the exploit server and change the file name to match the path used by the vulnerable response:
In the body, enter the payload
alert(document.cookie)and store the exploit.
GETrequest for the home page in Burp Repeater and remove the cache buster.
Add the following header, remembering to enter your own exploit server ID:
Send your malicious request. Keep replaying the request until you see your exploit server URL being reflected in the response and
X-Cache: hitin the headers.
To simulate the victim, load the poisoned URL in the browser and make sure that the
alert()is triggered. Note that you have to perform this test before the cache expires. The cache on this lab expires every 30 seconds.
- If the lab is still not solved, the victim did not access the page while the cache was poisoned. Keep sending the request every few seconds to re-poison the cache until the victim is affected and the lab is solved.