gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-12-06 04:40:58 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #774 from 1PingSun/master

Browse Source 
2025-04-04 Add Detecting Web Cache Deception Content
This commit is contained in:
Swissky
2025-08-13 16:04:43 +02:00
committed by GitHub
parent ad79082eb4 5bc06fee7c
commit 0c5b7c3953
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
Web Cache Deception/README.md
View File

@@ -90,6 +90,19 @@ The following URL format are a good starting point to check for "cache" feature.
* `https://example.com/app/conversation/;.js`
* `https://example.com/home.php/non-existent.css`
## Detecting Web Cache Deception
1. Detecting delimiter discrepancies: `/path/<dynamic-resource>;<static-resource>`
* For example: `/settings/profile;script.js`
* If the origin server uses `;` as a delimiter but the cache isn't
* The cache interprets the path as: `/settings/profile;script.js`
* The origin server interprets the path as: `/settings/profile`
* For more delimiter characters: see [Web cache deception lab delimiter list](https://portswigger.net/web-security/web-cache-deception/wcd-lab-delimiter-list)
2. Detecting normalization: `/wcd/..%2fprofile`
* If the origin server resolved the path traversal sequence but the cache isn't
* The cache interprets the path as: `/wcd/..%2fprofile`
* The origin server interprets the path as: `/profile`
## CloudFlare Caching
CloudFlare caches the resource when the `Cache-Control` header is set to `public` and `max-age` is greater than 0.