Web cache poisoning

Web cache poisoning is a sophisticated technique whereby an attacker manipulates a web server and its cache functionality to send other users a malicious HTTP response. In this recipe, we’ll exploit a vulnerable lab that does not properly validate input within an unkeyed header susceptible to web cache poisoning. This attack will take advantage of the web application’s home page, where unsuspecting visitors will be open to the attack. We’ll walk you through web cache poisoning in a response that causes the visitor’s browser to execute malicious JavaScript code.

Getting ready

This lab requires a PortSwigger Academy account and ZAP to intercept requests and responses from the server to your browser.

How to do it...

In this section, we will lay out the steps you can take to complete the PortSwigger Academy Web cache poisoning with an unkeyed header lab and poison the cache to display the cookie. To start the lab, take the following...