> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-via-abnormal-get-request.md).

# 通过异常的 GET 请求进行缓存投毒

### 通过带请求体的 GET 请求进行 Web 缓存投毒

该实验室容易受到 Web 缓存投毒，因为它接受 **带请求体的 GET 请求**，但 **请求体不包含在缓存键中**。/ 一位用户经常使用 Chrome 访问该网站的主页。/ 目标是对缓存进行投毒，使响应运行 `alert(1)` 在受害者的浏览器中。

**初步分析**

通过拦截对主页的请求，我们观察到存在以下 cookie

<pre class="language-http"><code class="lang-http"><strong>Cookie: country=[object Object]
</strong></code></pre>

该 cookie 由页面加载的 JavaScript 文件生成：

```bash
/js/geolocate.js
```

<figure><img src="/files/8745ad004a614da3e351cdef2af65d3d9aa7a395" alt=""><figcaption></figcaption></figure>

**对……的分析 `geolocate.js`**

直接访问以下内容：/ `/js/geolocate.js?callback=setCountryCookie`

得到以下代码：

{% code overflow="wrap" %}

```javascript
const setCountryCookie = (country) => {
    document.cookie = 'country=' + country;
};
const setLangCookie = (lang) => {
    document.cookie = 'lang=' + lang;
};
setCountryCookie"({"country":"United Kingdom"});
```

{% endcode %}

我们注意到：

* 该 `回调` 参数用于定义所调用的函数。
* 然后在客户端执行传入的值。

**漏洞利用**

加载主页时，网站会自动调用：/ `/js/geolocate.js?callback=setCountryCookie`

利用以下事实：

* 服务器接受带请求体的 GET 请求。
* 请求体不包含在缓存键中。

```bash
callback=alert(1)
```

<figure><img src="/files/791bf3ea5729265ffb200ad1d996f40f410c7631" alt=""><figcaption></figcaption></figure>

我们强制一个 **新参数 `回调`** 在 GET 请求的请求体中，赋予其以下值：

<figure><img src="/files/13811f93967817b961f24d030d20a1968d1ffce6" alt=""><figcaption></figcaption></figure>

缓存的响应现在包含对……的调用 `alert(1)`.

<figure><img src="/files/0228e9792c3e3998d066676cbbd9e7c97fdcc47e" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-via-abnormal-get-request.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.