> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-with-unkeyed-cookie.md).

# 使用未纳入缓存键的 Cookie 进行缓存投毒

### 使用未键入 Cookie 的 Web 缓存投毒

由于 Cookie 未包含在缓存键中，此实验室存在 Web 缓存投毒漏洞。一个合法用户会定期访问主页。/ 目标是用一个可执行的响应来投毒缓存 `alert(1)` 在受害者的浏览器中。

#### 响应分析

* 请求被拦截到根路径（`/`).
* 在 HTML 响应中，我们观察到一个包含动态数据的 JavaScript 脚本：

```javascript
<script>
  data = {
    "host":"0ab5006d03269ea785b94a9e000100c5.web-security-academy.net",
    "path":"/",
    "frontend":"prod-cache-01"
  }
</script>
```

* 该 `frontend` 字段是浏览器发送的一个 Cookie 的值

#### Cookie 观察

* 在请求中，名为 `fehost` 的 Cookie 存在：

```bash
fehost=prod-cache-01
```

* 该值被直接在响应中复用，而没有被纳入缓存键。

<figure><img src="/files/9c31bad0eb247d8477020c378491530d78ccde6e" alt=""><figcaption></figcaption></figure>

#### Cookie 操作

* 通过更改 `fehost` Cookie 的值，响应立即反映出新的值：

```bash
fehost=test
```

* 这证实了该 Cookie **未被编入缓存索引** 并且它会影响缓存内容。

<figure><img src="/files/2128478e8193e112cc39b6d81f354e817633c43b" alt=""><figcaption></figcaption></figure>

#### 载荷注入

* 随后将恶意值注入 Cookie 中，以破坏 JavaScript 上下文并执行任意代码：

```javascript
test"-alert(1)-"efffe
```

<figure><img src="/files/549403f7054b9596e292d8675021e4a13939b789" alt=""><figcaption></figcaption></figure>

* 载荷从 JavaScript 字符串中逃逸，并注入一个对以下内容的调用 `alert(1)`.

<figure><img src="/files/c2b68bf900b53a9e8923529208ab6af718ed82a6" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-with-unkeyed-cookie.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.