> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-fat-get-request.md).

# 通过肥 GET 请求进行 Web 缓存投毒

### 通过一个胖 GET 请求进行 Web 缓存投毒

这个实验室容易受到 Web 缓存投毒攻击，因为它接受 **带有请求体的 GET 请求**，但是 **请求体不包含在缓存键中**。/ 用户定期使用 Chrome 访问网站首页。/ 目标是投毒缓存，使响应执行 `alert(1)` 在受害者的浏览器中。

**初步分析**

通过拦截对首页的请求，我们观察到以下 cookie 的存在

<pre class="language-http"><code class="lang-http"><strong>Cookie: country=[object Object]
</strong></code></pre>

该 cookie 由页面加载的 JavaScript 文件生成：

```bash
/js/geolocate.js
```

<figure><img src="/files/8745ad004a614da3e351cdef2af65d3d9aa7a395" alt=""><figcaption></figcaption></figure>

**对以下内容的分析 `geolocate.js`**

直接访问以下地址：/ `/js/geolocate.js?callback=setCountryCookie`

得到以下代码：

{% code overflow="wrap" %}

```javascript
const setCountryCookie = (country) => {
    document.cookie = 'country=' + country;
};
const setLangCookie = (lang) => {
    document.cookie = 'lang=' + lang;
};
setCountryCookie"({"country":"United Kingdom"});
```

{% endcode %}

我们注意到：

* 该 `callback` 参数用于定义要调用的函数。
* 传入的值随后会在客户端执行。

**漏洞利用**

加载首页时，网站会自动调用：/ `/js/geolocate.js?callback=setCountryCookie`

通过利用以下事实：

* 服务器接受带有请求体的 GET 请求。
* 请求体不包含在缓存键中。

```bash
callback=alert(1)
```

<figure><img src="/files/791bf3ea5729265ffb200ad1d996f40f410c7631" alt=""><figcaption></figcaption></figure>

我们强制加入一个 **新参数 `callback`** 到 GET 请求的请求体中，并将其值设为：

<figure><img src="/files/13811f93967817b961f24d030d20a1968d1ffce6" alt=""><figcaption></figcaption></figure>

缓存的响应现在包含对 `alert(1)`.

<figure><img src="/files/0228e9792c3e3998d066676cbbd9e7c97fdcc47e" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-fat-get-request.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.