> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-parameter.md).

# 通过未参与缓存键的查询参数进行 Web 缓存投毒

### 通过未纳入键控的查询参数进行 Web 缓存投毒

该实验室存在 Web 缓存投毒攻击漏洞，因为一个查询参数未包含在缓存键中。/ 一名用户 नियमित使用 Chrome 访问网站首页。/ 目标是污染缓存，使首页返回一个运行着的响应 `alert(1)` 在受害者的浏览器中。

**初步分析**

* 通过拦截根页面的响应，观察到一个 **canonical** 链接。
* 如果你使用任意参数访问该 URL，例如 `/?hello`，该值会在响应中被很好地反映出来

<figure><img src="/files/5426261c0752821c11fff8ca4e630fb4517ff38b" alt=""><figcaption></figcaption></figure>

注入如下有效载荷：

```bash
/?test'/><script>alert(1)</script>
```

* HTML 代码会在响应中被解释，但受害者端不会触发任何警报。

<figure><img src="/files/30b6487b10c2c5188992119e623548a707789b88" alt=""><figcaption></figcaption></figure>

**已识别的问题**

缓存会将该参数的每种变化视为 `?test` 一个新的输入。/ 因此，每次值变化时，缓存都会重新生成，污染无法持续。

然而，某些参数 **完全被忽略** 在缓存键中：

* 它们的名称和值都不会被考虑。
* 即使它们的值发生变化，缓存响应仍保持不变。

**未纳入索引的参数识别**

<figure><img src="/files/39e19a1b298691a13b25646813ea139f0738fbbe" alt=""><figcaption></figcaption></figure>

使用 **Param Miner** （函数 Guess query parameters），该 `utm_content` 参数被识别出来。

<figure><img src="/files/b913b5039eefbde98062508fa9d700788a135d09" alt=""><figcaption></figcaption></figure>

* 通过测试该参数的不同值，我们发现缓存保持不变，这证实它未包含在缓存键中。

<pre class="language-bash"><code class="lang-bash"><strong>/?utm_content=test
</strong></code></pre>

<figure><img src="/files/2f01ef31da55fc042556ea2d7fd1611b4fd77cf2" alt=""><figcaption></figcaption></figure>

**利用**

随后将恶意有效载荷注入这个未纳入索引的参数中：

```bash
/?utm_content='/><script>alert(1)</script>
```

被污染的响应被存储在缓存中，并提供给后续访问者。

<figure><img src="/files/15868f8a71d4c028f8db0ee9d295cb3d287fc40e" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-parameter.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.