> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-string.md).
# 通过未键控查询字符串进行 Web 缓存投毒
通过未键控查询字符串进行 Web 缓存投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过未纳入键控的查询字符串进行 Web 缓存投毒
本实验演示了由于以下事实而导致的 Web 缓存投毒漏洞： **查询字符串未包含在缓存键中**。合法用户会定期使用 **Google Chrome**.
目标是投毒主页，使其返回一个包含 **正在运行的 JavaScript `alert(1)`** 在受害者的浏览器中。
***
**步骤 1：主页拦截**
对站点根路径（`/`）的请求被拦截。在响应中，我们观察到存在一个规范 **链接**，这表明 URL 的某些元素可以在 HTML 中被反映出来。
***
**步骤 2：查询字符串测试**
向 URL 中添加一个任意查询字符串：
```bash
/?test
```
该值被很好地 **反映在响应中**，这证实了查询字符串会影响返回的内容。
**步骤 3：HTML 注入**
然后修改查询字符串以注入 HTML：
```bash
/?test'/>
JORDAN
```
该 `
` 标签被浏览器正确解析，证明可以利用 \*\*HTML 注入\*\*。
**步骤 4：JavaScript 注入（缓存投毒）**
将 HTML 注入替换为一个 JavaScript 载荷：
```bash
/?test'/>
```
现在答案中包含了该脚本，且该脚本会被浏览器\*\*执行\*\*。
**结果**
由于查询字符串 **未包含在缓存键中**，被投毒的响应会被存储并提供给其他访问主页的用户。/ 随后受害者在访问期间会自动触发 `alert(1)` 的执行，从而验证了实验的操作效果。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-via-unkeyed-query-string.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
