SuperAPI AI Directory
Partner中文AI newsFavorites
Skillscache-poisoning-smuggling

cache-poisoning-smuggling

General & other

View repository

Updated 10-16 08:02

About this skill

Web Cache Poisoning & HTTP Request Smuggling

Two related but distinct advanced web attack techniques, both exploiting parsing discrepancies in multi-tier web architectures.

Part A: Web Cache Poisoning

Core idea: find anHTTP header that affects the response content but is not included in the cache key(unkeyed input), and inject malicious content into the cache.

A.1 Identify Cache Behavior

# 发送两次相同请求，检查响应头
http_request url="http://target/page" headers={"X-Test":"1"}

Cache indicators:

  • X-Cache: HIT/MISS
  • Age: 300(cache lifetime in seconds)
  • CF-Cache-Status: HIT（Cloudflare）
  • Via: 1.1 varnish

A.2 Discover Unkeyed Input

Test each HTTP header one by one to see whether it affects the response but does not change the cache key:

X-Forwarded-Host: evil.com     → 响应中出现 evil.com？
X-Forwarded-Scheme: http       → 强制 HTTP 重定向？
X-Original-URL: /admin         → 路径覆盖？
X-Rewrite-URL: /admin
X-Forwarded-For: 127.0.0.1    → 绕过 IP 限制？

A.3 Poisoning

If X-Forwarded-Host affects resource links in the response:

  1. Send a request with a malicious Header
  2. The response is cached (containing malicious content)
  3. Subsequent users visiting the same URL → receive the poisoned cache

Part B: HTTP Request Smuggling

Core idea: the front-end proxy and back-end server parse therequest boundaryinconsistently, causing one HTTP request to be parsed as two.

B.1 Identify Smuggling Type

Type Front-end determines length Back-end determines length
CL.TE Content-Length Transfer-Encoding
TE.CL Transfer-Encoding Content-Length
TE.TE Transfer-Encoding Transfer-Encoding (handling discrepancy)

B.2 CL.TE Detection

Front-end uses Content-Length, back-end uses Transfer-Encoding:

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

If the back-end processes SMUGGLED as the start of a new request → smuggling exists.

Time-delay detection method(more reliable): send an incomplete chunked body; if the front-end forwards it completely according to CL but the back-end waits for the remaining chunks → response timeout/time delay → CL.TE smuggling exists. The response difference (timeout vs normal) is the key basis for judgment.

B.3 TE.CL Detection

POST / HTTP/1.1
Host: target.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

B.4 Exploiting Smuggling

Bypass front-end security controls: Smuggle a request to access /admin , bypassing the front-end proxy's ACL.

Steal other users' requests: Smuggle an incomplete POST request; the back-end waits for more data → the next user's request gets appended → read their Cookie/Token.

Cache poisoning: Smuggle a request to a different path, causing the cache to store the wrong response content.

Notes

  • HTTP smuggling requires precise control of raw HTTP bytes; use curl --data-binary to send
  • The impact scope of cache poisoning depends on the TTL and key design
  • TE.TE obfuscation bypass:Transfer-Encoding: xchunked、Transfer-Encoding\n: chunked(newline/folding injection), multiple TE headers exploiting parsing discrepancies
  • After cache poisoning, XSS can be injected, loading malicious JS that affects all visitors

In-Depth References