> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/web-cache-deception/web-cache-deception-with-exact-match-rules.md).
# Web Cache Deception with Exact-Match Rules
Web Cache Deception with Exact-Match Rules notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting Exact-match Cache Rules for Web Cache Deception
#### Objective of the Lab
* Change user email address **administrator**.
* Connection available: **wiener:peter**.
* A list of delimiters is provided: Web cache deception lab delimiter list.
#### Context Observed
* On **My account**, there is a field to change the email.
* The request sent looks like:
```bash
email=test%40test.com&csrf=Bfo2p16Es7RG8W0XBZxAJSuyJKOHbK0a
```
#### Delimiter Tests
* By testing the characters of the list, the site accepts in particular:
* the **virgulate point** `;`
* the **question mark** `?`
Classic attacks do not work in this lab.
#### Discovery of a Hidden Resource
* From **Target -> Site map**, use **Discover content**.
* A **robots file. txt** appears and it is \*\* cached\*\*.
#### Cache Reception via Normalization (exact Path + Detour)
Purpose: Force the cache to store a sensitive response by making it look like a hidden resource.
Applications used:
```bash
GET /my-account;/../robots.txt
# Encoded version
GET /my-account;%2f%2e%2e%2frobots.txt
```
#### Exploit Sent to the Victim
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
Outcome:
* The page returned corresponds to the **administrator account**.
In the answer, we retrieve the **CSRF token** from the e-mail form, for example:
```html
```
#### Planned Final Stage
* Use this token to generate a **PoC CSRF** to send a **POST** request to the **My account** e-mail change page, and thus change the **administrator** e-mail.
```html
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/web-cache-deception/web-cache-deception-with-exact-match-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)