25.6 Lab: Web cache poisoning via an unkeyed query parameter

This lab is vulnerable to web cache poisoning because it excludes a certain parameter from the cache key. A user regularly visits this site’s home page using Chrome. To solve the lab, poison the cache with a response that executes alert(1) in the victim’s browser | Karthikeyan Nagaraj

Description

This lab is vulnerable to web cache poisoning because it excludes a certain parameter from the cache key. A user regularly visits this site’s home page using Chrome.

To solve the lab, poison the cache with a response that executes alert(1) in the victim's browser.

Hint

Websites often exclude certain UTM analytics parameters from the cache key.

Solution

1. Send the / request to repeater
2. Send a request with a utm_content parameter that breaks out of the reflected string and injects an XSS payload:
   GET /?utm_content='/><script>alert(1)</script>
3. Replay the request until the cache is poisoned for normal users. The lab will be solved when the victim user visits the poisoned home page.

A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups

Cyberw1ng

Telegram Channel for Free Ethical Hacking Dumps

Ethical Hacking Dumps — CEH, OSCP, Comptia

Thank you for Reading!

Happy Ethical Hacking ~

Author: Karthikeyan Nagaraj ~ Cyberw1ng