Lab3: Web cache poisoning via ambiguous requests — HTTP Host header attacks

In this lab The server interprets duplicate Host headers differently, allowing an attacker to influence a JavaScript resource URL included in the cached homepage.

What Is Web Cache Poisoning?

Web cache poisoning occurs when an attacker causes a caching system to store a manipulated HTTP response. When other users request the affected resource, the cache may serve the poisoned response to them.

What is cb?

cb stands for cache buster in this context. It is an arbitrary query parameter used during testing to obtain a separate cache entry when the cache key includes query parameters.

Example:

GET /?cb=123 HTTP/1.1

GET /?cb=123 HTTP/1.1

Changing the value, such as cb=456, may cause the cache to treat the request as a different entry. Its behaviour depends on the cache configuration.

Solution:

Intercept the homepage request using Burp Suite & change Host to any other domain.

It got an error so i keep 2 Host header.

It works in X-Cache it's miss but in response got an endpoint where the host is appers.

Send it 2nd 3rd

Now it's hit

Optional: You can use/?cb=123 and change the number to analyse the response.

This step is optional you can poison the homepage cache directly without the query parameter, you don't need to use a cache buster.

Now open that exploit server and configure it:

Store it.

Now copy the exploit URL & paste in home pages with Host header.

1st it miss but 2ndly or 3rd it works.

Lab solved if you want to see the alert open response in browser:

Thanks For Reading