Responsible denial of service with web cache poisoning
Summary: PortSwigger researcher James Kettle described using web cache poisoning to take down websites with a single request, including a WAF on Tesla's site that cached a 'you have been blocked' page for anyone sending 'burpcollaborator.net', earning a $300 bounty. He went on to earn over $10,000 from accidental DoS findings, with later bounties of $1,800 at Bitbucket, $9,700 at PayPal for replacing JavaScript files with a '501 Not Implemented' response, and $1,000 at Instagram for forcing a brotli-encoded response via an underscore in Accept_Encoding.
Why it matters: A single poisoned cache entry can persist and deny a page to every subsequent visitor, and PayPal paid a top-tier $9,700 for it - yet most bug-bounty policies still discourage DoS reports, so these vulnerabilities are less likely to be reported to you than exploited against you.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026