> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-parameter.md).
# Web Cache Poisoning via an Unkeyed Query Parameter
Web Cache Poisoning via an Unkeyed Query Parameter notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Web Cache Poisoning via an Unkeyed Query Parameter
This lab is vulnerable to a web cache poisoning attack as a query parameter is not included in the cache key. / A user regularly visits the home page of the site using Chrome. / The goal is to poison the cache so that the home page serves a reply running `alert(1)` in the victim's browser.
**Initial analysis**
* By intercepting the root page response, a **canonical** link is observed.
* If you access the URL with an arbitrary parameter, for example `/?hello`, the value is well reflected in the answer
Injecting a payload like:
```bash
/?test'/>
```
* HTML code is interpreted in response, but no alerts run on victim side.
**Identified problem**
The cache considers each variation of the `?test` parameter as a new input. / Thus, with each change in value, the cache is regenerated and poisoning does not persist.
However, some parameters are **totally ignored** by the cache key:
* Their name and value are not taken into account.
* The cached response remains the same, even if their value changes.
**Identification of the unindexed parameter**
Using **Param Miner** (function Guess query parameters ), the `utm_content` parameter is identified.
* By testing different values for this parameter, we find that the cache remains unchanged, confirming that it is not included in the cache key.
/?utm_content=test
**Exploitation**
The malicious payload is then injected into this unindexed parameter:
```bash
/?utm_content='/>
```
The poisoned response is stored in the cache and served to the following visitors.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-parameter.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
