Web Security
Web Cache Poisoning
Force a cache to serve your malicious response to every user who requests a page. By injecting unkeyed headers into a cacheable request, you can deliver XSS or redirects to thousands of victims at once.
Intermediate45 min6 lessons1 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Explain cache keys and why unkeyed headers create a poisoning surface
- ✓Detect cached responses using Age, X-Cache, and CF-Cache-Status headers
- ✓Find reflected unkeyed headers using canary values and confirm cacheability
- ✓Execute a cache poisoning attack that delivers stored XSS to all visitors
- ✓Apply Vary headers, strip unneeded proxy headers, and use Cache-Control: no-store