> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning.md).
# Web 缓存投毒
Web 缓存投毒、缓存键注入、未键控头、未键控 Cookie、参数伪装以及基于缓存的 XSS。
针对 PortSwigger Web Security Academy 实验的 Web 缓存投毒笔记，重点关注实际测试步骤、Burp Suite 验证、payload 行为以及利用流程。
## 测试流程
1. 识别存在漏洞的功能，以及相关的请求、参数、请求头、Cookie 或浏览器端 sink。
2. 在进一步发起攻击之前，先在 Burp Suite 中使用最小有效载荷复现该行为。
3. 使用清晰的概念验证来验证影响，例如账户访问、数据泄露、代码执行、SSRF 或状态变更。
4. 在记录利用路径时，保持有效载荷、URL、令牌和实验室凭据不变。
## 实验
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.