Mastering Web Cache Deception: PortSwigger 5 Labs

---

Web Cache Deception: Exploiting Path Mapping (PortSwigger Lab 1)

Subtitle: A Step-by-Step Guide to Solving the Apprentice Lab with Burp Suite

Introduction

Web Cache Deception is a vulnerability where an attacker tricks a web cache into storing sensitive, dynamic content. It occurs due to discrepancies between how the cache server and the origin server interpret a URL path.

In this writeup, we will solve the Apprentice-level PortSwigger Lab where we need to exploit path mapping to steal the API key of the user carlos.

Lab Objective: Find the API key for the user carlos. Credentials: wiener:peter

Step 1: Identifying the Target Endpoint

First, we need to find an endpoint that returns sensitive, dynamic data.

1. Log in to the application using the credentials wiener:peter.
2. Navigate to the My Account page (/my-account).
3. Notice that the response contains your API key. This confirms that the endpoint returns user-specific sensitive information.

Step 2: Analyzing the Path Mapping Discrepancy

To exploit this, we need to find a difference in how the origin server and the cache server map the URL path.

1. Open Burp Suite and intercept the GET /my-account request.
2. Send this request to Repeater.
3. Test the Origin Server: Modify the path to add an arbitrary segment, like /my-account/abc. Send the request.

• Observation: You still receive a response containing your API key. This indicates that the origin server uses REST-style routing and ignores the extra path segment /abc.

1. Test the Cache Server: Now, add a static file extension to the path. Change it to /my-account/abc.js. Send the request.

• Observation: Look at the response headers. You will see X-Cache: miss and Cache-Control: max-age=30.

1. Send the exact same request again within 30 seconds.

• Observation: The X-Cache header now changes to hit.

Conclusion: The cache server interprets the URL as a static JavaScript file because of the .js extension and caches the response. However, the origin server ignores the extension and returns the dynamic profile data.

Step 3: Crafting the Exploit

Now that we have a discrepancy, we can craft a malicious URL that forces the victim's browser to cache their own sensitive data.

1. Go to the Exploit Server provided in the lab.
2. In the Body section, use the following payload to redirect the victim:
3. html

1. (Note: Replace YOUR-LAB-ID with your actual lab instance ID).
2. Important: Make sure to use a new path segment (like xxxxxxxxxxx.js) instead of the one you tested earlier (abc.js). If you reuse the old path, you will just fetch your own cached data.
3. Click Store, then click Deliver exploit to victim.

Step 4: Retrieving the Cached Data

When the victim (carlos) views the exploit, their browser makes a request to /my-account/xxxxxxxxxxx.js with their session cookies. The origin server returns Carlos's profile data, and the cache server stores it.

1. Wait 2–3 seconds for the cache to update.
2. Open an Incognito window (or use Burp Repeater) and request the exact same URL:
3. http

• GET /my-account/xxxxxxxxxxx.js HTTP/1.1
• Host: YOUR-LAB-ID.web-security-academy.net

1. (Do not use your logged-in browser, or you will see your own data).
2. Look for the X-Cache: hit header to confirm it is serving from the cache.
3. In the response body, you will see Carlos's API key.

Step 5: Submitting the Solution

Copy Carlos's API key, click Submit solution at the top of the lab page, and paste the key. The lab will be marked as Solved.

Key Takeaways

• The Vulnerability: The cache server used file extensions (.js) to decide what to cache, while the origin server used RESTful routing to ignore extra path segments.
• The Exploit: By combining both behaviors, we tricked the cache into storing a dynamic response for a URL it thought was a static file.
• Prevention: Applications should set Cache-Control: no-store, private on sensitive endpoints, and caches should never rely solely on file extensions to determine if a response is cacheable.

Happy Hacking! Always practice on authorized targets like PortSwigger Web Security Academy.

==============================================================