Top 10 winner

Practical Web Cache Poisoning

James Kettle · PortSwigger Research · 9 August 2018

Unkeyed request inputs such as X-Forwarded-Host or X-Original-URL change a response that a cache then stores under an ordinary key, so every later visitor is served the attacker's version. The work chains this into stored XSS, hijacked script and JSON loads, open redirects, Open Graph spoofing and cross-region CDN poisoning, and ships a Burp extension for finding unkeyed inputs.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

9 August 2018

In the archive

• Ranked #2 in the 2018 Top 10 Web Hacking Techniques

Related sources

• Research tool
• Mitigation follow-up
• Availability follow-up
• Talk recording
• Talk recording
• Talk recording

Tags

• cache-poisoning
• header-injection
• open-redirect
• xss
• cache
• cdn
• drupal
• http
• tooling
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.