> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-string.md).

# 通过未参与缓存键的查询字符串进行 Web 缓存投毒

### 通过未键控的查询字符串进行 Web 缓存投毒

本实验展示了 Web 缓存因……而易遭投毒的漏洞，原因是 **查询字符串未包含在缓存键中**。一个合法用户会定期使用 **Google Chrome**.

访问站点主页。目标是污染主页，使其返回一个包含 **正在运行的 JavaScript `alert(1)`** 在受害者的浏览器中。

***

**步骤 1：主页拦截**

对站点根路径（`/`）的请求被拦截。/ 在响应中，我们观察到存在一个 canonical **链接**，这表明 URL 的某些元素可以在 HTML 中被反射。

***

**步骤 2：查询字符串测试**

向 URL 添加一个任意查询字符串：

```bash
/?test
```

该值很好地 **反映在响应中**，这证实了查询字符串会影响返回的内容。

<figure><img src="/files/442f5be1924c15ab8cce488a89213fc3ab32d3a4" alt=""><figcaption></figcaption></figure>

**步骤 3：HTML 注入**

然后修改查询字符串以注入 HTML：

```bash
/?test'/><h1>JORDAN</h1>
```

该 `<h1>` 标签被浏览器正确解析，表明存在可利用的 \*\*HTML 注入\*\*。

<figure><img src="/files/c921ceff8fb6e667a067de4ba35328234b366821" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3a3bea6d69ae7d77fc35179d69b40d59dd8b5ae9" alt=""><figcaption></figcaption></figure>

**步骤 4：JavaScript 注入（缓存投毒）**

将 HTML 注入替换为 JavaScript 载荷：

```bash
/?test'/><script>alert(1)</script>
```

现在响应包含了脚本，该脚本会被浏览器\*\*执行\*\*。

<figure><img src="/files/ac69e9b03f0c341aa2d6549c4c11687b77003e3b" alt=""><figcaption></figcaption></figure>

**结果**

由于查询字符串 **未包含在缓存键中**，被投毒的响应会被存储并提供给其他访问主页的用户。/ 受害者随后会在其访问期间自动触发 `alert(1)` 的执行，从而验证该实验已成功。

<figure><img src="/files/250a2d2951fc1481d64dbf055eb5acbfd66ab083" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-string.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.