Cache Poisoning labs
Web Cache Poisoning
What is Cache Poisoning?
Web Cache Poisoning abuses inputs not included in the cache key (unkeyed inputs) to store a malicious response that's then served to all users. With headers like X-Forwarded-Host you inject XSS, redirects or defacement served straight from the cache.
Why practice Cache Poisoning?
CDNs and caches are in almost every modern app, and the cache-key model is hard to tune. A poisoned response is served to thousands of users from the cache: it turns a low-impact reflected input into a mass, persistent XSS or redirect. Typical bounties: $1,000-$15,000.
What will you learn with the Cache Poisoning labs?
You'll learn to identify whether a response is cacheable (Age, X-Cache, Cache-Control), discover inputs not in the key (X-Forwarded-Host, X-Forwarded-Scheme, custom headers), reflect them into the response, and poison the cache to hit third parties without touching their browser directly.
Types of Cache Poisoning we cover
- Unkeyed header → XSS
An unkeyed header (X-Forwarded-Host) reflects in the page and gets cached. The cache serves your XSS to everyone.
- Unkeyed header → redirect
X-Forwarded-Host used to build absolute URLs poisons links/redirects toward your domain.
- Cache deception
Tricking the cache into storing a private page (adding /nonexistent.css) and serving it to another user.
- Fat GET / parameter cloaking
Discrepancies between what the proxy caches and what the origin processes to smuggle unkeyed inputs.
How do you find and exploit Cache Poisoning?
A practical playbook — from recon to proof of concept.
- 1
Detect that the response is cached
Request the resource twice and check cache headers. A growing Age or X-Cache: HIT confirms there's a cache in front.
curl -sI https://target/?x=1 | grep -iE 'age|x-cache|cf-cache-status' - 2
Look for inputs not in the key
Add proxy headers and see whether they change the response without being part of the cache key (same URL, different content).
GET / HTTP/1.1\nHost: target\nX-Forwarded-Host: evil.com - 3
Confirm the input reflects
Check that your unkeyed header ends up in the response (in a link, a script, a canonical URL).
<link rel=canonical href="https://evil.com/"> · <script src="//evil.com/x.js"> - 4
Poison the cache
Repeat the request with the payload until the malicious version is cached; verify others receive it without sending the header.
After N requests with X-Forwarded-Host:evil.com → the cache serves evil.com to everyone - 5
Try cache deception
As a variant, force the cache to store an authenticated page by adding a static extension to the URL.
https://target/account/profile/nonexistent.css → cached and served to others
Learn the theory
Academy: Advanced Techniques
Loading labs...
View in full catalog →Frequently asked questions
What is Web Cache Poisoning?
It's an attack that leverages inputs not included in the cache key (unkeyed) so the server stores a malicious response. Once cached, that response is served to every user requesting the same resource, spreading XSS, redirects or defacement.
How is Web Cache Poisoning exploited?
You identify an unkeyed header (like X-Forwarded-Host) that reflects in the response, send it with a payload, and repeat until the cache stores the poisoned version. From then on, other users receive the malicious content without sending that header.
How do you find Cache Poisoning in bug bounty?
Confirm there's a cache (Age, X-Cache), test proxy headers (X-Forwarded-Host/Scheme, custom headers) with Burp's Param Miner to detect unkeyed inputs, and verify they reflect and get cached, affecting clean requests.
How do you prevent Web Cache Poisoning?
Include in the cache key every input that affects the response, normalize or ignore untrusted headers, don't build absolute URLs from headers like X-Forwarded-Host, and clearly separate cacheable content from personalized content.
Difference between Cache Poisoning and Cache Deception?
In Cache Poisoning the attacker poisons a response so it's served to others (impact on third parties). In Cache Deception they trick the cache into storing the victim's private page and later retrieve it (theft of the victim's data). Opposite vectors over the same cache layer.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Cache Poisoning in real labs
Every Cache Poisoning lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime