> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-fat-get-request.md).
# 通过臃肿 GET 请求进行 Web 缓存投毒
通过臃肿 GET 请求进行 Web 缓存投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过大体积 GET 请求进行 Web 缓存投毒
此实验室容易受到 Web 缓存投毒攻击，因为它接受 **带有请求正文的 GET 请求**，但 **请求正文不包含在缓存键中**. / 一名用户经常使用 Chrome 访问该站点的主页。/ 目标是投毒缓存，使响应运行 `alert(1)` 在受害者的浏览器中。
**初始分析**
通过拦截对主页的请求，我们观察到存在以下 cookie
Cookie: country=[object Object]
该 cookie 由页面加载的 JavaScript 文件生成：
```bash
/js/geolocate.js
```
**分析 `geolocate.js`**
直接访问以下内容：/ `/js/geolocate.js?callback=setCountryCookie`
获得以下代码：
{% code overflow="wrap" %}
```javascript
const setCountryCookie = (country) => {
document.cookie = 'country=' + country;
};
const setLangCookie = (lang) => {
document.cookie = 'lang=' + lang;
};
setCountryCookie"({"country":"United Kingdom"});
```
{% endcode %}
我们观察到：
* 该 `回调` 参数用于定义被调用的函数。
* 随后传递的值会在客户端执行。
**漏洞利用**
加载主页时，网站会自动调用：/ `/js/geolocate.js?callback=setCountryCookie`
利用以下事实：
* 服务器接受带有请求正文的 GET 请求。
* 请求正文不包含在缓存键中。
```bash
callback=alert(1)
```
我们强制一个 **新参数 `回调`** 到 GET 请求的正文中，并将其设为以下值：
缓存的响应现在包含对 `alert(1)`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-fat-get-request.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
