Listen to this Post
Introduction
Cache poisoning is a sophisticated web attack where an attacker manipulates cached responses to serve malicious content to unsuspecting users. This underrated vulnerability can lead to phishing, session hijacking, or malware distribution. In this article, we’ll explore how cache poisoning works, demonstrate exploitation techniques, and provide mitigation strategies.
Learning Objectives
- Understand how HTTP cache poisoning works.
- Learn how to test for cache poisoning vulnerabilities.
- Implement defenses against cache poisoning attacks.
You Should Know
1. How Cache Poisoning Works
Command:
curl -H "Host: evil.com" http://victim.com/ -v
Step-by-Step Guide:
- The attacker sends a request to `victim.com` but manipulates the `Host` header to
evil.com. - If the server improperly caches this response, subsequent users requesting `victim.com` may receive a poisoned response containing `evil.com` links.
- This can lead to phishing, credential theft, or redirection to malicious sites.
2. Testing for Cache Poisoning
Command:
httpx -l targets.txt -header "Host: evil.com" -status-code -title
Step-by-Step Guide:
- Use `httpx` (from ProjectDiscovery) to test multiple domains with a spoofed `Host` header.
- Check if the response reflects `evil.com` in links or redirects.
- Verify if the poisoned response is cached by accessing the same URL from a different IP.
3. Exploiting Cache Poisoning via HTTP Headers
Command:
curl -H "X-Forwarded-Host: evil.com" http://victim.com/ -v
Step-by-Step Guide:
- Some servers use `X-Forwarded-Host` for caching instead of
Host. - Inject a malicious domain and observe if the response is cached.
- If successful, all users will see `evil.com` content when visiting
victim.com.
4. Mitigating Cache Poisoning
Command (Nginx Configuration):
proxy_cache_key "$scheme$request_method$host$request_uri";
Step-by-Step Guide:
- Ensure caching servers use a strict cache key including
$host.
2. Disable caching for sensitive endpoints.
- Implement proper header validation to reject malicious `Host` or `X-Forwarded-Host` values.
5. Detecting Cache Poisoning via Burp Suite
Steps:
- Intercept a request to the target in Burp Suite.
- Modify the `Host` header and forward the request.
- Check if the response reflects the poisoned domain.
- Use Burp Repeater to verify if the response is cached.
6. Automating Cache Poisoning Tests
Command:
ffuf -u http://victim.com -H "Host: FUZZ.evil.com" -w subdomains.txt
Step-by-Step Guide:
- Use `ffuf` to fuzz the `Host` header with different subdomains.
2. Monitor responses for cache poisoning indicators.
3. If successful, escalate by testing real-world impact.
7. Preventing Cache Poisoning in Cloudflare
Steps:
1. In Cloudflare, navigate to Caching > Configuration.
- Enable Cache Key Normalization to prevent header manipulation.
- Set Origin Cache-Control to `no-store` for dynamic content.
What Undercode Say
- Key Takeaway 1: Cache poisoning is often overlooked but can have severe consequences, including mass phishing attacks.
- Key Takeaway 2: Proper caching logic and header validation are critical to preventing exploitation.
Analysis:
Cache poisoning remains a significant threat due to misconfigured CDNs and caching servers. As web applications rely more on distributed caching, attackers find new ways to exploit weak cache validations. Organizations must implement strict cache-control policies, monitor for anomalous headers, and conduct regular penetration testing to identify vulnerabilities before attackers do.
Prediction
As edge computing and serverless architectures grow, cache poisoning attacks may evolve to target new caching layers. Automated scanning tools will become essential for detecting cache-related vulnerabilities early in development. Expect stricter caching standards from major CDN providers to mitigate these risks.
Further Learning:
For advanced web hacking techniques, check out the BAC & IDOR Hunting Course.
IT/Security Reporter URL:
Reported By: Jainireshj Cache – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
