> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-via-unindexed-query-parameter.md).
# 通过未编入索引的查询参数进行缓存投毒
通过未编入索引的查询参数进行缓存投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过未纳入缓存键的查询参数进行 Web 缓存投毒
此实验室存在 Web 缓存投毒漏洞，因为某个查询参数未被包含在缓存键中。/ 用户经常使用 Chrome 访问网站主页。/ 目标是污染缓存，使主页返回运行着 `alert(1)` 在受害者的浏览器中。
**初始分析**
* 通过拦截主页响应，可以观察到一个 **规范** 链接。
* 如果你使用任意参数访问该 URL，例如 `/?hello`，该值会被很好地反映在响应中
注入如下有效载荷：
```bash
/?test'/>
```
* 响应中会解析 HTML 代码，但受害者端不会弹出任何警报。
**识别到的问题**
缓存会将每一种 `?test` 参数变体视为新的输入。/ 因此，每当值发生变化时，缓存都会重新生成，投毒无法持续。
然而，有些参数 **会被完全忽略** 在缓存键中：
* 它们的名称和值都不会被考虑。
* 即使它们的值发生变化，缓存的响应仍保持不变。
**未纳入索引的参数识别**
使用 **Param Miner** （函数 Guess query parameters），该 `utm_content` 参数被识别出来。
* 通过测试该参数的不同值，我们发现缓存保持不变，证实它没有被包含在缓存键中。
/?utm_content=test
**利用**
随后将恶意载荷注入这个未被索引的参数中：
```bash
/?utm_content='/>
```
被投毒的响应会被存储到缓存中，并提供给后续访问者。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-via-unindexed-query-parameter.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
